Submission Summary:

• Submission details:
• Submission received: 10 September 2012, 13:16:08
• Processing time: 7 min 51 sec
• Submitted sample:
• File MD5: 0x929946914777210FA55505D65049D5C2
• File SHA-1: 0xB9D2D8DEB4E0CBA0E6D29417E8C02A975DF11976
• Filesize: 14,848 bytes
• Alias:
• Generic Dropper.p [McAfee]
• Trojan:Win32/Meredrop [Microsoft]
• Trojan.Win32.Tdss [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Registers a Winlogon notification package so that the installed module is loaded into the address space of winlogon.exe.
Creates a startup registry entry.

Technical Details:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\povstak.dll	15,872 bytes	MD5: 0x009B6B555010A3A51B94A0961F9BFBE8 SHA-1: 0xE282C81B9BD91899ACA0E890E94107207266B551	Proxy-Bunitu.a [McAfee] TrojanProxy:Win32/Bunitu.B [Microsoft] Trojan-Proxy.Win32.Bunitu [Ikarus]
2	[file and pathname of the sample #1]	14,848 bytes	MD5: 0x929946914777210FA55505D65049D5C2 SHA-1: 0xB9D2D8DEB4E0CBA0E6D29417E8C02A975DF11976	Generic Dropper.p [McAfee] Trojan:Win32/Meredrop [Microsoft] Trojan.Win32.Tdss [Ikarus]

• Note:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

Memory Modifications

• There was a new process created in the system:

• The following module was loaded into the address space of other process(es):

Registry Modifications

• The following Registry Key was created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\povstak

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\povstak]
• Impersonate = 0x00000001
• Asynchronous = 0x00000001
• MaxWait = 0x00000001
• sjghsgru = BB 0F 0D A9 EE 3E 34 A4 A9 BB
• DllName = "%AppData%\povstak.dll"
• Startup = "povstak"

so that povstak.dll is installed as a Winlogon notification package

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• povstak = "rundll32 "%AppData%\povstak.dll",povstak"

so that povstak.dll runs every time Windows starts

Other details

• To mark the presence in the system, the following Mutex object was created:
• IUMAE5-UJOWW8-XWW3R

• The following ports were open in the system:

• The following Host Names were requested from a host database:
• 192.5.5.241
• ns08.nyamnyam.in

• There was registered attempt to establish connection with the remote host. The connection details are: