Submission Summary:

• Submission details:
• Submission received: 5 October 2012, 10:23:45
• Processing time: 8 min 59 sec
• Submitted sample:
• File MD5: 0x9EAB51105A39ADE556E62E31FF52DE63
• File SHA-1: 0x5071B911E0E333B2A9C786CB15DF77FBFAB31286
• Filesize: 122,880 bytes
• Alias:
• Generic PWS.y!1lc [McAfee]
• PWS:Win32/Fareit [Microsoft]
• Trojan.Win32.FakeAV [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.

Technical Details:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\abcd.bat	75 bytes	MD5: 0x0849CFE65B98BA5FCD9A9EC61A671D09 SHA-1: 0x9D0CCB383C32B1BC07FD9064B9324A18E1276902	Other [Ikarus]
2	[file and pathname of the sample #1]	122,880 bytes	MD5: 0x9EAB51105A39ADE556E62E31FF52DE63 SHA-1: 0x5071B911E0E333B2A9C786CB15DF77FBFAB31286	Generic PWS.y!1lc [McAfee] PWS:Win32/Fareit [Microsoft] Trojan.Win32.FakeAV [Ikarus]

• Note:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\Software\WinRAR

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\WinRAR]
• HWID = 7B 43 39 37 46 42 32 33 37 2D 39 44 42 31 2D 34 32 45 33 2D 39 45 46 38 2D 42 39 46 38 38 30 43 32 44 45 38 32 7D

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Russian Federation

• The following Host Names were requested from a host database:
• antihelp.org
• getssh.org

• The following HTTP URL was started reading:
• http://getssh.org/setup.exe

Downloaded File Summary:

• Download details:
• Download retrieved: 5 October 2012 10:35:47
• Processing time: 9 min 13 sec
• Downloaded sample:
• File MD5: 0x835908997E2DDA7CAAC14833AF790C43
• File SHA-1: 0x012F4375BD212F5231FEF8D8A14B6C22882BD6A8
• Filesize: 488,960 bytes

• Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.

Technical Details:

File System Modifications

• The following files were created in the system:

• Note:
• %CommonAppData% is a variable that refers to the file system directory containing application data for all users. A typical path is C:\Documents and Settings\All Users\Application Data.

• The following directory was created:
• %CommonAppData%\CDE75CA74F8D1A400000CDE75BDA3480

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
• CDE75CA74F8D1A400000CDE75BDA3480 = "%CommonAppData%\CDE75CA74F8D1A400000CDE75BDA3480\CDE75CA74F8D1A400000CDE75BDA3480.exe"

so that CDE75CA74F8D1A400000CDE75BDA3480 runs every time Windows starts

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Russian Federation