Submission Summary:

• Submission details:
• Submission received: 5 March 2009, 02:46:12
• Processing time: 9 min 46 sec
• Submitted sample:
• File MD5: 0xCC13C4D43927206FBC01445590E2C961
• File SHA-1: 0x5DF0B6475CFD5028B6B1546EDE70C27AEA380E90
• Filesize: 49,152 bytes
• Alias: VirTool.Win32.DelfInject [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Hosts file modification that may block access to the security web sites.
Communication with a remote IRC server.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\WER4afa.dir00\manifest.txt	1,332 bytes	MD5: 0xF15BC28FBD8E7EEEE24547B590BB5F04 SHA-1: 0xB4D151B03B04CFC95CD6594A12800E311EA791F3	(not available)
2	%Temp%\WER4afa.dir00\sysdata.xml	115,010 bytes	MD5: 0x8E2DDAB7F8924828F278A4697C9E76B9 SHA-1: 0xC14119899A0D98B95CE5BB835CF94475AF0A0FA2	(not available)
3	%System%\msnmessage7.7.exe [file and pathname of the sample #1]	49,152 bytes	MD5: 0xCC13C4D43927206FBC01445590E2C961 SHA-1: 0x5DF0B6475CFD5028B6B1546EDE70C27AEA380E90	VirTool.Win32.DelfInject [Ikarus]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following directory was created:
• %Temp%\WER4afa.dir00

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
msnmessage7.7.exe	%System%\msnmessage7.7.exe	81,920 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	81,920 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\ipconfig
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\ipconfig\DEBUG
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\ipconfig\DEBUG]
• Trace Level = ""
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
• NoClose = 0x00000001
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• Msn Message Acount Helper 7.7 = "msnmessage7.7.exe"

so that msnmessage7.7.exe runs every time Windows starts

Other details

• To mark the presence in the system, the following Mutex objects were created:
• V6.1
• V6.x

• The HOSTS file was updated with the following URL-to-IP mappings:

• The following Host Name was requested from a host database:
• sexy.NUDECRUZES.COM

• There was registered attempt to establish connection with the remote host. The connection details are:

Outbound traffic (potentially malicious)

• Attention! There was a new connection established with a remote IRC Server. The generated outbound IRC traffic is provided below: