Submission Summary:

• Submission details:
• Submission received: 21 September 2012, 15:41:48
• Processing time: 7 min 56 sec
• Submitted sample:
• File MD5: 0xD5AC4CABCEFEBAF191166882FE2FF702
• File SHA-1: 0xD46AC5C520A15A0B18335BC6D79F5DA72809546F
• Filesize: 526,848 bytes
• Alias:
• W32.Stration@mm [Symantec]
• Trojan-Downloader.Win32.Banload.acjd [Kaspersky Lab]
• Mal/Generic-L [Sophos]
• Backdoor.Win32.Bifrose [Ikarus]
• Win-Trojan/Banload.526848.C [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Capability to send out email message(s) with the built-in SMTP client engine.
Contains characteristics of an identified security risk.

Technical Details:

• The new window was created, as shown below:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Trojan.Crypt.S	Trojan.Crypt.S is a backdoor trojan which opens a random port and allows hackers to gain unauthorised access to the infected system. It also attempts to terminate antivirus, firewall and other security related processes.
Email-Worm.Warezov!sd6	Email-Worm.Warezov!sd6 is a mass mailing worm which will send huge volume of emails to other email addresses from infected machines via external mail servers.

• Attention! The following threat categories were identified:

Threat Category	Description
	A program that downloads files to the local computer that may represent security risk
	A network-aware worm that attempts to replicate across the existing network(s)

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	[file and pathname of the sample #1]	526,848 bytes	MD5: 0xD5AC4CABCEFEBAF191166882FE2FF702 SHA-1: 0xD46AC5C520A15A0B18335BC6D79F5DA72809546F	W32.Stration@mm [Symantec] Trojan-Downloader.Win32.Banload.acjd [Kaspersky Lab] Mal/Generic-L [Sophos] Backdoor.Win32.Bifrose [Ikarus] Win-Trojan/Banload.526848.C [AhnLab]

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Keys were created:
• HKEY_CURRENT_USER\Software\EES
• HKEY_CURRENT_USER\Software\EES\BIFROST1.1

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\EES\BIFROST1.1]
• pass = "mypass"
• port = D0 07 00 00
• msnPopup = 01 00 00 00

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Sweden

• To mark the presence in the system, the following Mutex object was created:
• BIFROST1.1

• The following port was open in the system: