Submission Summary:

• Submission details:
• Submission received: 11 December 2010, 00:02:49
• Processing time: 11 min 47 sec
• Submitted sample:
• File MD5: 0xB1C27D6E055C887181611FCF736CF39C
• File SHA-1: 0x94F3C9BC312135135B2377A52BC8553C1E5316B9
• Filesize: 1,044,480 bytes
• Alias:
• Trojan.Win32.VBKrypt.bjq [Kaspersky Lab]
• VirTool:Win32/VBInject.gen!CN [Microsoft]
• Trojan.Win32.VBKrypt [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%System%\csrss\csrss.exe [file and pathname of the sample #1]	1,044,480 bytes	MD5: 0xB1C27D6E055C887181611FCF736CF39C SHA-1: 0x94F3C9BC312135135B2377A52BC8553C1E5316B9	Trojan.Win32.VBKrypt.bjq [Kaspersky Lab] VirTool:Win32/VBInject.gen!CN [Microsoft] Trojan.Win32.VBKrypt [Ikarus]
2	%System%\csrss\logs.dat	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)
3	%System%\csrss\plugin.dat	581,632 bytes	MD5: 0x5DF04454161B456E94AE6FA5F9B80F13 SHA-1: 0x8C59E40AB5F9DC3101C5D1D8C2D2FEC46535D77D	(not available)

• Note:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following directory was created:
• %System%\csrss

Memory Modifications

• There was a new process created in the system:

• There were new memory pages created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	585,728 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	606,208 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	606,208 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	606,208 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	606,208 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	606,208 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	606,208 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	606,208 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	606,208 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	606,208 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	606,208 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	606,208 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	606,208 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	606,208 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	606,208 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	782,336 bytes

• Notes:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{Y22SOV53-0UY5-DG2H-T7SF-GI000G82RXT4}
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideo
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
• HKEY_CURRENT_USER\Software\Cerberus

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{Y22SOV53-0UY5-DG2H-T7SF-GI000G82RXT4}]
• StubPath = "%System%\csrss\csrss.exe Restart"

so that csrss.exe runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• csrss = "%System%\csrss\csrss.exe"

so that csrss.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• csrss = "%System%\csrss\csrss.exe"

so that csrss.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Cerberus]
• FirstExecution = "12/11/2010"
• FileName = "Dlzcs1JtFiFdifAOxfQDRfRiNiFWg65U2HRwRn9aUB/HHrJ"
• HKLM = "jZnNAhB"
• HKCU = "jZnNAhB"

Other details

• There was registered attempt to establish connection with the remote host. The connection details are:

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 5150: