Submission Summary:

• Submission details:
• Submission received: 27 October 2009, 09:48:42
• Processing time: 7 min 17 sec
• Submitted sample:
• File MD5: 0xA5C7DB762E8281DDF4A8222BE55410F7
• File SHA-1: 0xDBD837E8624EA9856AED8DB857402D5F06B948FC
• Filesize: 63,488 bytes
• Alias & packer info:
• Trojan-Downloader.Delphi [Ikarus]
• packed with: PE_Patch.UPX [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Registers a 32-bit in-process server DLL.
Registers a Browser Helper Object (Microsoft's Internet Explorer plugin module).

Technical Details:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%ProgramFiles%\real\realplayer\acpi.vxd	1,952 bytes	MD5: 0xF20FF0FB2F01440FE1B9C5ABA8E5674C SHA-1: 0xA0E6194B0210114648CC4F772FD681B17507A9E6	(not available)
2	%ProgramFiles%\real\realplayer\realUpdateNT.exe	355,840 bytes	MD5: 0xA976E3444C13490BACBA991B041D1824 SHA-1: 0xBBC594F422D52FA11AB351BE70C7A423DA05A6DB	packed with PE_Patch.UPX [Kaspersky Lab]
3	%ProgramFiles%\real\realplayer\rpshell32.dll	537,088 bytes	MD5: 0x70B5425D459EAA26E0FB96C379C82831 SHA-1: 0x31EF80544C33B0AFE2692C7891E2EE38FA5D0718	packed with PE_Patch.UPX [Kaspersky Lab]
4	%Windir%\system\bestPratices.cmd	278 bytes	MD5: 0x7C92956F905EF26D3A0190E8E3D0CD46 SHA-1: 0x3CA6318D2158BF2D76C972ABAF0C3A776A17F62F	(not available)
5	%Windir%\system\[filename of the sample #1] [file and pathname of the sample #1]	63,488 bytes	MD5: 0xA5C7DB762E8281DDF4A8222BE55410F7 SHA-1: 0xDBD837E8624EA9856AED8DB857402D5F06B948FC	Trojan-Downloader.Delphi [Ikarus] packed with PE_Patch.UPX [Kaspersky Lab]
6	%System%\bestPratices.cmd	284 bytes	MD5: 0x7DAB779A618590135DCEF6F1CD55B36E SHA-1: 0xB75D876A60223CAC20463C24BA90F1F9ACCF7C8F	(not available)

• Notes:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following directories were created:
• %ProgramFiles%\real
• %ProgramFiles%\real\realplayer

Memory Modifications

• There were new processes created in the system:

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{510C6CB8-1CC5-4694-B6F7-9E8D76991F0C}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{510C6CB8-1CC5-4694-B6F7-9E8D76991F0C}\InprocServer32
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{510C6CB8-1CC5-4694-B6F7-9E8D76991F0C}

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE]
• EnableLUA = 0x00000000
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{510C6CB8-1CC5-4694-B6F7-9E8D76991F0C}\InprocServer32]
• (Default) = "C:\PROGRA~1\real\REALPL~1\RPSHEL~1.DLL"
• ThreadingModel = "Apartment"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{510C6CB8-1CC5-4694-B6F7-9E8D76991F0C}]
• (Default) = "Real Player "
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{510C6CB8-1CC5-4694-B6F7-9E8D76991F0C}]
• NoExplorer = 0x00000001
• (Default) = "Real Player "

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Brazil

• There were registered attempts to establish connection with the remote hosts. The connection details are:

• The data identified by the following URLs was then requested from the remote web server:
• http://ulm-taxi.com.br/terranos/monumentos.js
• http://ulm-taxi.com.br/terranos/territorio.js
• http://vieclamhanoi.com.br/terranos/monumentos.js