Submission Summary:

• Submission details:
• Submission received: 29 April 2009, 14:53:03
• Processing time: 6 min 30 sec
• Submitted sample:
• File MD5: 0xA2A6455A4DA0192FB8EFE85E98FD3DFA
• File SHA-1: 0xA9A65198CF692A306BE1E23C9E965549B7294B26
• Filesize: 8,192 bytes
• Alias:
• Trojan-Downloader.Agent!sd6 [PCTools]
• Downloader [Symantec]
• Trojan-Downloader.Win32.Agent.aemu [Kaspersky Lab]
• TROJ_AGENT.AXBZ [Trend Micro]
• Mal/EncPk-EI [Sophos]
• TrojanDownloader:Win32/Obitel.gen!A [Microsoft]
• Trojan-Dropper.Agent [Ikarus]
• Win-Trojan/Agent.8192.MQ [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Trojan-Downloader.Agent!sd6	Trojan-Downloader.Agent!sd6 attempts to download malicious files to the local computer and execute them.

• Attention! The following threat category was identified:

Threat Category	Description
	A program that downloads files to the local computer that may represent security risk

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\in1.tmp	2,495 bytes	MD5: 0x30C188166D6418833A176323F852CCE9 SHA-1: 0xE1D51AEA4223F806AC1CBA3E5249DA1F8980F071	(not available)
2	[file and pathname of the sample #1]	8,192 bytes	MD5: 0xA2A6455A4DA0192FB8EFE85E98FD3DFA SHA-1: 0xA9A65198CF692A306BE1E23C9E965549B7294B26	Trojan-Downloader.Agent!sd6 [PCTools] Downloader [Symantec] Trojan-Downloader.Win32.Agent.aemu [Kaspersky Lab] TROJ_AGENT.AXBZ [Trend Micro] Mal/EncPk-EI [Sophos] TrojanDownloader:Win32/Obitel.gen!A [Microsoft] Trojan-Dropper.Agent [Ikarus] Win-Trojan/Agent.8192.MQ [AhnLab]
3	%System%\stus.exe	24,576 bytes	MD5: 0x39B1FFB03C2296323832ACBAE50D2AFF SHA-1: 0xE5AEDCBE25A97C89101F1F3860FF846E94D70445	(not available)

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following file was modified:
• %System%\userinit.exe

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	20,480 bytes
stus.exe	%System%\stus.exe	32,768 bytes

Registry Modifications

• The following Registry Values were modified:
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Providers]
• LogonTime = 6A B4 CE 83 1D C9 C9 01
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Providers]
• LogonTime = 6A B4 CE 83 1D C9 C9 01