Submission Summary:

• Submission details:
• Submission received: 23 September 2012, 04:01:26
• Processing time: 10 min 12 sec
• Submitted sample:
• File MD5: 0x925C365576CBF8B30F44246946ABE197
• File SHA-1: 0x2E8F4738B7D15E2688AD062702D027D095990B23
• Filesize: 999,850 bytes
• Alias:
• Trojan-Dropper.Win32.VBInject.s [Kaspersky Lab]
• Win-Trojan/Buzus.98304.X [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\Microsoft\Crypto\RSA\S-1-5-21-606747145-764733703-839522115-1003\699c4b9cdebca7aaea5193cae8a50098_a7bcc1a4-f7a4-4502-8650-8579e607f7f7	50 bytes	MD5: 0x5B63D4DD8C04C88C0E30E494EC6A609A SHA-1: 0x884D5A8BDC25FE794DC22EF9518009DCF0069D09	(not available)
2	%Temp%\IXP000.TMP\Crypter.exe %Temp%\IXP001.TMP\Crypter.exe	67,590 bytes	MD5: 0x5FC6D1783AACBBEDECF1B0726953341F SHA-1: 0xEC9BD56FCF6253A2997AA79341C4C162C5342A35	Trojan.Gen [Symantec] Trojan.Win32.Buzus.klat [Kaspersky Lab] Generic.dx!bczf [McAfee] VirTool:Win32/Vbinder.CN [Microsoft] Trojan.SuspectCRC [Ikarus]
3	%Temp%\IXP000.TMP\YEIKEL~1.EXE %Temp%\IXP001.TMP\YEIKEL~1.EXE	536,576 bytes	MD5: 0x45EDBB358882DC52FB8FE356A6DC6335 SHA-1: 0xBD342B5291AB680AA1484C411CBCC8DE5B8F7C8C	Trojan.Gen [Symantec] Trojan-Dropper.Win32.Agent.eauv [Kaspersky Lab] Generic.bfr!ez [McAfee] Trojan:Win32/Orsam!rts [Microsoft] Trojan-Dropper.Win32.KGen [Ikarus]
4	c:\Extracted\2012 Yeikel Crypter.exe	535,552 bytes	MD5: 0xB6CFE283A559CAB730C842AD83E339AA SHA-1: 0x8D65872B071F1DBC50FF2271D5104A1454E3C30B	Trojan.Gen [Symantec] Trojan-Dropper.Win32.Agent.eauv, Trojan.Win32.Buzus.klat [Kaspersky Lab] Trojan.SuspectCRC [Ikarus]
5	c:\Extracted\Stub.exe	429,534 bytes	MD5: 0xE4D632835563C623FF7ECE7DBF9C9815 SHA-1: 0xE4DF30CA2AD43F3B7D35819A17FE36D308414FB2	Trojan.Gen [Symantec] Trojan-Dropper.Win32.VBInject.s [Kaspersky Lab] VirTool:Win32/VBInject.UG [Microsoft] Trojan-Dropper.Win32.VB [Ikarus]
6	[file and pathname of the sample #1]	999,850 bytes	MD5: 0x925C365576CBF8B30F44246946ABE197 SHA-1: 0x2E8F4738B7D15E2688AD062702D027D095990B23	Trojan.Win32.Buzus.klat, Trojan-Dropper.Win32.VBInject.s [Kaspersky Lab] Win-Trojan/Buzus.98304.X [AhnLab]

• Notes:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

• The following directories were created:
• %Temp%\IXP001.TMP
• %Temp%\IXP000.TMP
• c:\Extracted

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
YEIKEL~1.EXE	%Temp%\ixp001.tmp\yeikel~1.exe	540,672 bytes
crypter.exe	%Temp%\ixp000.tmp\crypter.exe	319,488 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	122,880 bytes
YEIKEL~1.EXE	%Temp%\IXP000.TMP\YEIKEL~1.EXE	540,672 bytes
Crypter.exe	%Temp%\IXP001.TMP\Crypter.exe	20,480 bytes

Registry Modifications

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
• wextract_cleanup0 = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 "%Temp%\IXP000.TMP\""
• wextract_cleanup1 = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 "%Temp%\IXP001.TMP\""

Other details

• To mark the presence in the system, the following Mutex object was created:
• )!VoqA.I4

• The following Host Name was requested from a host database:
• bonbino.no-ip.info

• There was registered attempt to establish connection with the remote host. The connection details are:

• There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:
• %System%\MSVBVM60.DLL

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 3460: