Submission Summary:

• Submission details:
• Submission received: 30 December 2008, 10:09:24
• Processing time: 6 min 38 sec
• Submitted sample:
• File MD5: 0xCD192EFEBDEEB1DC40656AFAFEF554F7
• File SHA-1: 0x0BBECAB9EB91630082BD187AF588E54762269FD9
• Filesize: 2,028,610 bytes
• Alias:
• Backdoor.Win32.Bifrose.afgu [Kaspersky Lab]
• Constructor.Win32.Bifrose [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Capability to terminate Antivirus, Firewall and other security related processes.
Produces outbound traffic.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A hacktool that could be used by attackers to break into a system
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\bifrost saudi hack v0.2.exe	1,915,381 bytes	MD5: 0x56DA7AB39B9CACA88AE328D6E75A96C8 SHA-1: 0x4E459B8D01EF2C7842ED18B294A318E691105232	Backdoor.Bifrose [Symantec] Constructor.Win32.Bifrose.bn [Kaspersky Lab] New Malware.eh [McAfee] Backdoor:Win32/Bifrose.gen!B [Microsoft] Constructor.Win32.Bifrose [Ikarus]
2	%Temp%\lssas	148 bytes	MD5: 0x74C8A3E448FA87D42F694AEBA4E41ACE SHA-1: 0x5042BCC02CEC3326EF87B7749AFB06AC3C90C6F9	(not available)
3	%Temp%\lssas.exe	47,651 bytes	MD5: 0xAFB630143FD68CB987873ECAE3D0A8C1 SHA-1: 0x4CE43DC57F3DE719082AA2B3BF17C6AA0A82B454	Trojan-Downloader.VB [Ikarus]
4	[file and pathname of the sample #1]	2,028,610 bytes	MD5: 0xCD192EFEBDEEB1DC40656AFAFEF554F7 SHA-1: 0x0BBECAB9EB91630082BD187AF588E54762269FD9	Backdoor.Win32.Bifrose.afgu [Kaspersky Lab] Constructor.Win32.Bifrose [Ikarus]

• Note:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

• The following directory was created:
• %Temp%\Computers

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
bifrost saudi hack v0.2.exe	%Temp%\bifrost saudi hack v0.2.exe	1,941,504 bytes
lssas.exe	%Temp%\lssas.exe	9,216 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	69,632 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2553A222-0354-B257-D660-57B9B1202DDB}
• HKEY_CURRENT_USER\Software\BIFROST1.2

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2553A222-0354-B257-D660-57B9B1202DDB}]
• StubPath = "%Temp%\lssas.exe"

so that lssas runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• save = "%Temp%\lssas.exe"

so that lssas runs every time Windows starts

• [HKEY_CURRENT_USER\Software\BIFROST1.2]
• settings = 51 00 00 00 00 00 00 00 00 00 00 00 6D 79 70 61 73 73 00 00 00 00 00 00 00 00 00 00 61 64 64 6F 6E 2E 64 61 74 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00

Other details

• Analysis of the file resources indicate the following possible countries of origin:

	Sweden
	Germany

• To mark the presence in the system, the following Mutex objects were created:
• )!VoqA.I4
• BIFROST1.2

• The following Host Name was requested from a host database:
• hamo0odi.no-ip.biz

• There was registered attempt to establish connection with the remote host. The connection details are:

• There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:
• %Temp%\lssas.exe

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 14079:

Heuristics Analysis

• Heuristically identified capability to terminate the following security related processes: