Submission Summary:

• Submission details:
• Submission received: 10 December 2008, 08:14:45
• Processing time: 6 min 27 sec
• Submitted sample:
• File MD5: 0xA4F025331518F4AE96915FC55A4F2D38
• File SHA-1: 0xF67D4F685CF0C4DC968EF514C99F42E6FC17817B
• Filesize: 33,280 bytes
• Alias & packer info:
• Trojan.Dropper [Symantec]
• Mal/Behav-009 [Sophos]
• Trojan-Dropper.Win32.Agent [Ikarus]
• packed with: UPX [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Trojan-Downloader.Rellik	Trojan-Downloader.Rellik will download additional malware onto infected computers. It also terminates various antivirus software services if they were found.

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\3fc82.dll	2,560 bytes	MD5: 0x2B0FFA696536D232479D999997C10D48 SHA-1: 0xA46797A5C2D7AD024E12E88AB02C21DF9FA130A8	Trojan-Downloader.Rellik [PCTools] Virus.Win32.Runner.Z [Ikarus]
2	[file and pathname of the sample #1]	33,280 bytes	MD5: 0xA4F025331518F4AE96915FC55A4F2D38 SHA-1: 0xF67D4F685CF0C4DC968EF514C99F42E6FC17817B	Trojan.Dropper [Symantec] Mal/Behav-009 [Sophos] Trojan-Dropper.Win32.Agent [Ikarus] packed with UPX [Kaspersky Lab]

• Note:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Memory Modifications

• There was a new process created in the system:

• There was a new kernel-mode driver installed in the system:

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_KISSTUSB
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_KISSTUSB\0000
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_KISSTUSB\0000\Control
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_KISSTUSB
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_KISSTUSB\0000
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_KISSTUSB\0000\Control

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_KISSTUSB\0000\Control]
• *NewlyCreated* = 0x00000000
• ActiveService = "Kisstusb"
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_KISSTUSB\0000]
• Service = "Kisstusb"
• Legacy = 0x00000001
• ConfigFlags = 0x00000000
• Class = "LegacyDriver"
• ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
• DeviceDesc = "Kisstusb"
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_KISSTUSB]
• NextInstance = 0x00000001
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_KISSTUSB\0000\Control]
• *NewlyCreated* = 0x00000000
• ActiveService = "Kisstusb"
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_KISSTUSB\0000]
• Service = "Kisstusb"
• Legacy = 0x00000001
• ConfigFlags = 0x00000000
• Class = "LegacyDriver"
• ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
• DeviceDesc = "Kisstusb"
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_KISSTUSB]
• NextInstance = 0x00000001

Other details

• Analysis of the file resources indicate the following possible country of origin:

	China

• To mark the presence in the system, the following Mutex object was created:
• iiopoip

• The data identified by the following URL was then requested from the remote web server:
• http://tongji.ombb888.cn/getmac.asp?x=0&y=a1&t=0

• The following Internet downloads were started (the retrieved bits are saved into the local file):

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).