Submission Summary:

• Submission details:
• Submission received: 21 September 2012, 09:27:59
• Processing time: 9 min 14 sec
• Submitted sample:
• File MD5: 0xCA719C4AAB5C2FCA482763BD0F5F4FAD
• File SHA-1: 0x37DAC5A381EFE5D0F5BAC9196E7B6DFEE80BF590
• Filesize: 295,936 bytes
• Alias:
• Trojan.Gen.2 [Symantec]
• PWS-Zbot.gen.amk [McAfee]
• Trojan-Dropper.Win32.Dapato [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

• Note:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

• The following directories were created:
• %AppData%\TeamViewer
• %AppData%\TeamViewer\{641C3246-EDE7-4679-ABB1-829DCB1CD0DB}

Memory Modifications

• There were new processes created in the system:

Registry Modifications

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• LicenseValidator = "%AppData%\Identities\{4EB15054-DDE0-4579-8522-F970A14F9D26}\LicenseValidator.exe"

Other details

• To mark the presence in the system, the following Mutex objects were created:
• Global\NtKernelProc.1300
• NtKernelInjLock
• Global\NtSys32AutoLock
• Global\NtKernelProc.156
• Global\NtKernelProc.200
• Global\NtKernelProc.2148