Submission Summary:

• Submission details:
• Submission received: 28 August 2012, 11:10:50
• Processing time: 8 min 12 sec
• Submitted sample:
• File MD5: 0xC970A9DD758FC1620684F85731610D4D
• File SHA-1: 0x3ED34887B65F48DAEA269CA49D0A31EDC99BF0F2
• Filesize: 269,824 bytes
• Alias & packer info:
• W32.Spyrat [Symantec]
• Trojan.Win32.Llac.gfu [Kaspersky Lab]
• Worm.Win32.Rebhip [Ikarus]
• packed with: UPX [Kaspersky Lab]

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\cglogs.dat	15 bytes	MD5: 0xBF3DBA41023802CF6D3F8C5FD683A0C7 SHA-1: 0x466530987A347B68EF28FAAD238D7B50DB8656A5	(not available)
2	%Temp%\UuU.uUu	8 bytes	MD5: 0xC363D0D6C361C19857C76BF0A5A1B8A3 SHA-1: 0x2B24BEF9C382F7ADB365B07E8FEEDCE3E1859978	(not available)
3	%Temp%\XxX.xXx	8 bytes	MD5: 0x7DEA362B3FAC8E00956A4952A3D4F474 SHA-1: 0x05FE405753166F125559E7C9AC558654F107C7E9	(not available)
4	%System%\controlp.exe	269,824 bytes	MD5: 0xC970A9DD758FC1620684F85731610D4D SHA-1: 0x3ED34887B65F48DAEA269CA49D0A31EDC99BF0F2	W32.Spyrat [Symantec] Trojan.Win32.Llac.gfu [Kaspersky Lab] Worm.Win32.Rebhip [Ikarus] packed with UPX [Kaspersky Lab]

• Notes:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There was a new memory page created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	397,312 bytes

• Notes:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{17564C2H-5U15-AD2W-I8W2-04Y0LSXEIQ00}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
• HKEY_CURRENT_USER\Software\reto_malware

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{17564C2H-5U15-AD2W-I8W2-04Y0LSXEIQ00}]
• StubPath = "%System%\controlp.exe Restart"

so that controlp.exe runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
• Policies = "%System%\controlp.exe"

so that controlp.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
• Policies = "%System%\controlp.exe"

so that controlp.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\reto_malware]
• FirstExecution = "28/08/2012 -- 11:10"
• NewIdentification = "reto_malware"
• NewGroup = ""

Other details

• To mark the presence in the system, the following Mutex objects were created:
• _x_X_UPDATE_X_x_
• _x_X_PASSWORDLIST_X_x_
• _x_X_BLOCKMOUSE_X_x_