Submission Summary:

• Submission details:
• Submission received: 22 September 2012, 15:22:54
• Processing time: 9 min 5 sec
• Submitted sample:
• File MD5: 0x8A2121E1D00B49C473444A4E0C02CEE4
• File SHA-1: 0xDEF0ECB8EC5AD4F45766EAD9237850EA9071A032
• Filesize: 81,131 bytes
• Alias:
• Suspicious.DLoader [Symantec]
• Trojan.Win32.Buzus.lba [Kaspersky Lab]
• BackDoor-DOQ.gen.aj [McAfee]
• TROJ_BUZUS.TCC [Trend Micro]
• Troj/Buzus-DX [Sophos]
• VirTool:Win32/DelfInject.gen!AA [Microsoft]
• Trojan.SuspectCRC [Ikarus]
• Win-Trojan/Xema.variant [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\addon.dat	24,929 bytes	MD5: 0xE0E6FD063BDE9D1D959FC48A3484F041 SHA-1: 0xB870BD634FFA06D9B006F5C406659095220DDBD4	(not available)
2	%System%\explorer.exe\explorer.exe [file and pathname of the sample #1]	81,131 bytes	MD5: 0x8A2121E1D00B49C473444A4E0C02CEE4 SHA-1: 0xDEF0ECB8EC5AD4F45766EAD9237850EA9071A032	Suspicious.DLoader [Symantec] Trojan.Win32.Buzus.lba [Kaspersky Lab] BackDoor-DOQ.gen.aj [McAfee] TROJ_BUZUS.TCC [Trend Micro] Troj/Buzus-DX [Sophos] VirTool:Win32/DelfInject.gen!AA [Microsoft] Trojan.SuspectCRC [Ikarus] Win-Trojan/Xema.variant [AhnLab]
3	%System%\explorer.exe\klog.dat	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)

• Notes:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following directory was created:
• %System%\explorer.exe

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
explorer.exe	%System%\explorer.exe\explorer.exe	94,208 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	94,208 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{150B825B-3A6A-DF9B-DD4B-DBF50AB84509}
• HKEY_LOCAL_MACHINE\SOFTWARE\explorer
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideo
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
• HKEY_CURRENT_USER\Software\explorer

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{150B825B-3A6A-DF9B-DD4B-DBF50AB84509}]
• stubpath = "%System%\explorer.exe\explorer.exe s"

so that explorer.exe runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SOFTWARE\explorer]
• nck = FF 37 C3 12 85 09 82 32 74 C3 CD 74 FA 93 5B 67
• [HKEY_CURRENT_USER\Software\explorer]
• klg = 01

Other details

• The following Host Name was requested from a host database:
• hackerz.no-ip.biz

• There was registered attempt to establish connection with the remote host. The connection details are:

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 81: