Submission Summary:

• Submission details:
• Submission received: 14 September 2012, 04:47:55
• Processing time: 13 min 29 sec
• Submitted sample:
• File MD5: 0xA9CB8FD0F48896E6C48FE5FD8030EC91
• File SHA-1: 0xE1FD0E6C7BA3D2A50966AA3F719004089A569CA8
• Filesize: 126,976 bytes

• Summary of the findings:

What's been found	Severity Level
Creates an executable file in the fake Recycle Bin folder with the purpose of concealing its presence in the system.
Creates desktop.ini system file in the fake Recycle Bin folder in order to register it in Windows as a valid Recycle Bin.
Creates fake Recycle Bin folder.
Communication with a remote IRC server.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

• The following directory was created:
• c:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013

Memory Modifications

• There were new processes created in the system:

Registry Modifications

• The following Registry Key was created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612}

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612}]
• StubPath = "c:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\dci.exe"

so that dci.exe runs every time Windows starts

Other details

• The following Host Name was requested from a host database:
• deci.xtraikarus.com

Outbound traffic (potentially malicious)

• Attention! There was a new connection established with a remote IRC Server. The generated outbound IRC traffic is provided below: