Submission Summary:

• Submission details:
• Submission received: 5 March 2008, 15:07:16
• Processing time: 3 min 52 sec
• Submitted sample:
• File MD5: 0xB36324DC4F46D550DE6F6D072306CBA5
• File SHA-1: 0x13D3AFBD6A586D5E7766564E33A37611B60B7D30
• Filesize: 65,710 bytes
• Alias:
• P2P-Worm.Win32.SpyBot.gl [Kaspersky Lab]
• Generic PWS.y [McAfee]

• Summary of the findings:

What's been found	Severity Level
Replication across networks by exploiting weekly restricted shares (common for Randex family of worms).
Communication with a remote IRC server.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A network-aware worm that attempts to replicate across the existing network(s)
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Windir%\SoftWareProtector\SpyBot_original_out	37 bytes	MD5: 0xF9F65F51A9B671080F243C7F621407B0 SHA-1: 0x0F47C4278773F8BAC8A28D0CE098FAE6C9349126	(not available)
2	[file and pathname of the sample #1]	65,710 bytes	MD5: 0xB36324DC4F46D550DE6F6D072306CBA5 SHA-1: 0x13D3AFBD6A586D5E7766564E33A37611B60B7D30	P2P-Worm.Win32.SpyBot.gl [Kaspersky Lab] Generic PWS.y [McAfee]

• Note:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

• The following directory was created:
• %Windir%\SoftWareProtector

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• ValueS0ft = "\[filename of the sample #1]"
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
• ValueS0ft = "\[filename of the sample #1]"

Other details

• To mark the presence in the system, the following Mutex object was created:
• ?15,0D3v1Lz-Spy?14,0 Done By ?1,0sNoOp_DoOg?14,0 For D3v1Lz T34m?15,0 Special Version

• The following port was open in the system:

• The following Host Name was requested from a host database:
• DsBots.Dev1lz.Com

Outbound traffic (potentially malicious)

• Attention! There was a new connection established with a remote IRC Server. The generated outbound IRC traffic is provided below:

Heuristics Analysis

• The network replication uses a dictionary attack by probing credentials from the following list: