Submission Summary:

• Submission details:
• Submission received: 11 September 2012, 08:41:36
• Processing time: 8 min 55 sec
• Submitted sample:
• File MD5: 0x8B04D72277331A55251483BC4BC17ADA
• File SHA-1: 0x98BD387A7880A06EDD216BBC0598E972B6728066
• Filesize: 272,070 bytes
• Alias:
• W32.SillyFDC [Symantec]
• Worm.Win32.AutoIt.ou [Kaspersky Lab]
• Worm.Win32.AutoIt [Ikarus]

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A network-aware worm that attempts to replicate across the existing network(s)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\autorun.inf	334 bytes	MD5: 0x96F4627214A44D3F609BA34CFAAC3BED SHA-1: 0x05C08EF0CF925DB1F3290444E4EA52A786D78164	Trojan.Win32.Autoit.aah [Kaspersky Lab] Mal/AutoInf-C [Sophos]
2	%Temp%\files\desktop.ini %Temp%\Infection\files\desktop.ini c:\files\desktop.ini	129 bytes	MD5: 0xA526B9E7C716B3489D8CC062FBCE4005 SHA-1: 0x2DF502A944FF721241BE20A9E449D2ACD07E0312	(not available)
3	%Temp%\Infection\RemoteINF.exe %Temp%\RemoteINF.exe c:\RemoteINF.exe	277,342 bytes	MD5: 0xAFA53C5704FDD4D0F005DCA0AE57054B SHA-1: 0xE710A929A8E96DDA0DDA40D1F5E533D4B72A621B	W32.SillyFDC [Symantec] Worm.Win32.AutoIt.ou [Kaspersky Lab] W32/Autorun.worm.bdq [McAfee] Trojan:Win32/Malat [Microsoft] Worm.Win32.AutoIt [Ikarus] packed with UPX [Kaspersky Lab]
4	[file and pathname of the sample #1]	272,070 bytes	MD5: 0x8B04D72277331A55251483BC4BC17ADA SHA-1: 0x98BD387A7880A06EDD216BBC0598E972B6728066	W32.SillyFDC [Symantec] Worm.Win32.AutoIt.ou [Kaspersky Lab] Worm.Win32.AutoIt [Ikarus]

• Note:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

• The following directories were created:
• %Temp%\files
• %Temp%\Infection
• %Temp%\Infection\files
• c:\files

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
RemoteINF.exe	%Temp%\remoteinf.exe	704,512 bytes
RemoteINF.exe	c:\remoteinf.exe	704,512 bytes
remoteinf.exe	%Temp%\infection\remoteinf.exe	704,512 bytes

Registry Modifications

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• RemoteInfection = "%Temp%\RemoteINF.exe"

so that RemoteINF.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• RemoteInfection = "%Temp%\RemoteINF.exe"

so that RemoteINF.exe runs every time Windows starts

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
• Shell =

Other details

• Analysis of the file resources indicate the following possible country of origin:

	United Kingdom

• The following Host Name was requested from a host database:
• 192.5.5.241

• The following Internet Connection was established:

• The following GET request was made:
• Files/recmd.ini

• The data identified by the following URLs was then requested from the remote web server:
• http://neothedm.isa-geek.org/Files/recmd.ini
• localhost