ThreatExpert Report: Backdoor.Eterok.C, Trojan-Mailfinder.Win32.Small.ag, Backdoor.Trojan..

Submission Summary:

Submission details:

Submission received: 6 October 2008, 16:31:32
Processing time: 5 min 54 sec
Submitted sample:

File MD5: 0xE427F1C2438259B5B4BB386AEC822E30
File SHA-1: 0xF4A4D303D8FC97D3C2BE101823D4DE3F474F025E
Filesize: 42,497 bytes

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Backdoor.Eterok!sd6	Backdoor.Eterok!sd6 is a malicious application that runs in the background and allows remote access to your system, giving the attacker full control of your system.
Backdoor.IRCBot!sd6	Backdoor.IRCBot!sd6 is a family of IRC backdoors allowing unauthorized access to an infected PC. It has the capability to spread over a network exploiting various Windows vulnerabilities.

Attention! The following threat category was identified:

Threat Category	Description
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\Settings\arm64.dll	36,352 bytes	MD5: 0xD7EA57CA184DD5FF659939DD011068D9 SHA-1: 0xAA3D15D7684A4C2E5CA327AD87B4F0FE76C61772	Backdoor.Eterok.C [Symantec]
2	c:\Settings\desktop.ini	23 bytes	MD5: 0x1DCB3C720DD35021C77AA0F4736FCAC8 SHA-1: 0xF6F47FB397EA7903C4239BFFD00699CEBC8C6909	(not available)
3	[file and pathname of the sample #1]	42,497 bytes	MD5: 0xE427F1C2438259B5B4BB386AEC822E30 SHA-1: 0xF4A4D303D8FC97D3C2BE101823D4DE3F474F025E	(not available)
4	%Windir%\Temp\1.tmp	17,408 bytes	MD5: 0x6CE19F9949EB9D5FC194B136E47750D5 SHA-1: 0x1FB04A4FF26953576FFBE00C178D52639E0EA385	Trojan-Mailfinder.Win32.Small.ag [Kaspersky Lab]
5	%Windir%\Temp\3.sys	1,792 bytes	MD5: 0xF703533D22BBD751237AF15D5F41D076 SHA-1: 0x483CB71589AB547A3C212C611335EE67486686FA	Backdoor.Trojan [Symantec] Backdoor.Win32.IRCBot.csk [Kaspersky Lab] W32/Sdbot.worm [McAfee] TROJ_AGENT.AXAT [Trend Micro] Troj/Inject-DA [Sophos]
6	%Windir%\Temp\3.tmp	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)

Note:

%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

The following directory was created:

c:\Settings

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	61,440 bytes

There was a new service created in the system:

Service Name	Display Name	Status	Service Filename
AppMgmt	AppMgmt	"Stopped"	%System%\svchost.exe -k netsvcs

Notes:

%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following system service was modified:

Service Name	Display Name	New Status	Service Filename
ALG	Application Layer Gateway Service	"Stopped"	%System%\alg.exe

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_APPMGMT
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_APPMGMT\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_APPMGMT\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_APPMGMT
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_APPMGMT\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_APPMGMT\0000\Control

The following Registry Keys were deleted:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\TPSvc
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft]

iInstall = "r"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion]

AppData = 36 59 CB AA 50 B4 20 D4 D5 64 A8 91 DA 80 D0 60 92 39 3F BD EC B2 47 89 23 9A 2E A6 DA 60 12 42 CD D6 4E 81 F1 82 57 5E 31 46 1E DB EE F1 B3 97 5F FC 1A 36 F5 A8 A1 26 A6 DF 7A 08 85 0E 1C 7B 77 88 BF 6C 22 4A 1B 20 CB C9 EB 1B F4 C9 13 90 26 72 D4 B
LastAppCrash32 = 0x01C92774

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_APPMGMT\0000\Control]

*NewlyCreated* = 0x00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_APPMGMT\0000]

Service = "AppMgmt"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "AppMgmt"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_APPMGMT]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_APPMGMT\0000\Control]

*NewlyCreated* = 0x00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_APPMGMT\0000]

Service = "AppMgmt"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "AppMgmt"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_APPMGMT]

NextInstance = 0x00000001

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

ProxyEnable = 0x00000000

The following Registry Values were deleted:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]

DLLName = "wlnotify.dll"
Logon = "RegisterTicketExpiredNotificationEvent"
Logoff = "UnregisterTicketExpiredNotificationEvent"
Impersonate = 0x00000001
Asynchronous = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\TPSvc]

Asynchronous = 0x00000000
Impersonate = 0x00000000
DllName = "TPSvc.dll"
Logoff = "TSEventLogoff"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]

Asynchronous = 0x00000000
DllName = "wlnotify.dll"
Impersonate = 0x00000000
Logoff = "TSEventLogoff"
Logon = "TSEventLogon"
PostShell = "TSEventPostShell"
Shutdown = "TSEventShutdown"
StartShell = "TSEventStartShell"
Startup = "TSEventStartup"
MaxWait = 0x00000258
Reconnect = "TSEventReconnect"
Disconnect = "TSEventDisconnect"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]

DLLName = "WlNotify.dll"
Lock = "SensLockEvent"
Logon = "SensLogonEvent"
Logoff = "SensLogoffEvent"
Safe = 0x00000001
MaxWait = 0x00000258
StartScreenSaver = "SensStartScreenSaverEvent"
StopScreenSaver = "SensStopScreenSaverEvent"
Startup = "SensStartupEvent"
Shutdown = "SensShutdownEvent"
StartShell = "SensStartShellEvent"
PostShell = "SensPostShellEvent"
Disconnect = "SensDisconnectEvent"
Reconnect = "SensReconnectEvent"
Unlock = "SensUnlockEvent"
Impersonate = 0x00000001
Asynchronous = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]

Logoff = "WLEventLogoff"
Impersonate = 0x00000000
Asynchronous = 0x00000001
DllName = "sclgntfy.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]

Asynchronous = 0x00000000
DllName = "wlnotify.dll"
Impersonate = 0x00000000
StartShell = "SchedStartShell"
Logoff = "SchedEventLogOff"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]

DLLName = "wlnotify.dll"
Logon = "SCardStartCertProp"
Logoff = "SCardStopCertProp"
Lock = "SCardSuspendCertProp"
Unlock = "SCardResumeCertProp"
Enabled = 0x00000001
Impersonate = 0x00000001
Asynchronous = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]

DLLName = "cscdll.dll"
Logon = "WinlogonLogonEvent"
Logoff = "WinlogonLogoffEvent"
ScreenSaver = "WinlogonScreenSaverEvent"
Startup = "WinlogonStartupEvent"
Shutdown = "WinlogonShutdownEvent"
StartShell = "WinlogonStartShellEvent"
Impersonate = 0x00000000
Asynchronous = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]

Asynchronous = 0x00000000
Impersonate = 0x00000000
DllName = "cryptnet.dll"
Logoff = "CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]

Asynchronous = 0x00000000
Impersonate = 0x00000000
DllName = "crypt32.dll"
Logoff = "ChainWlxLogoffEvent"

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]

(Default) = 0x0000000C

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent]

(Default) = 0x0000000C

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]

Cookies = "%UserProfile%\Cookies"
Cache = "%LocalSettings%\Temporary Internet Files"
History = "%LocalSettings%\History"

Other details

The following Host Names were requested from a host database:

192.168.1.164
microsoft.com
simdream.net

The following Internet Connections were established:

Server Name	Server Port	Connect as User	Connection Password
simdream.net	80	(null)	(null)
simdream.biz	80	(null)	(null)
simdream.info	80	(null)	(null)

The following HTTP URL was started reading:

http://simdream.net/pnew/work.php?spm=2&method=reg&tds=1

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.