Submission Summary:

• Submission details:
• Submission received: 21 June 2012, 00:58:15
• Processing time: 15 min 40 sec
• Submitted sample:
• File MD5: 0x95C800E294B699AD41362F180094568F
• File SHA-1: 0x9DDDDEC6DA9D26B8F91359FCD1EA1354BD2FD98B
• Filesize: 13,824 bytes
• Alias:
• Trojan.Gen.2 [Symantec]
• Backdoor.Win32.Androm.a [Kaspersky Lab]
• Generic.dx!b2kf [McAfee]
• Trojan.Win32.Spy [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AllUsersProfile%\svchost.exe [file and pathname of the sample #1]	13,824 bytes	MD5: 0x95C800E294B699AD41362F180094568F SHA-1: 0x9DDDDEC6DA9D26B8F91359FCD1EA1354BD2FD98B	Trojan.Gen.2 [Symantec] Backdoor.Win32.Androm.a [Kaspersky Lab] Generic.dx!b2kf [McAfee] Trojan.Win32.Spy [Ikarus]

• Note:
• %AllUsersProfile% is a variable that specifies the all users' profile folder. By default, this is C:\Documents and Settings\All Users (Windows NT/2000/XP).

Registry Modifications

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• SunJavaUpdateSched = "%AllUsersProfile%\svchost.exe"

so that svchost.exe runs every time Windows starts