Submission Summary:

• Submission details:
• Submission received: 7 December 2009, 00:15:36
• Processing time: 8 min 24 sec
• Submitted sample:
• File MD5: 0xEEC53E2239800E5D85B6B85D5E2451CB
• File SHA-1: 0x62FC2EA484ABC6ECF11381727A2FF776A14C60B6
• Filesize: 18,944 bytes
• Alias:
• Trojan.Dropper [Symantec]
• Trojan.Win32.Sasfis.vbw [Kaspersky Lab]
• Generic Dropper.mx [McAfee]
• Mal/EncPk-LP [Sophos]
• Trojan:Win32/Oficla.E [Microsoft]
• Trojan.Win32.Sasfis [Ikarus]
• Win-Trojan/Malware.18944.J [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Trojan.Sasfis	Trojan.Sasfis runs silently in the background and can download and install additional malware when executed.

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\1.tmp %System%\wdni.buo	25,089 bytes	MD5: 0x7BC3622A7097B4BBC92CFEEA55E97A4C SHA-1: 0xB4A026D2A7E88645BD2602901891AF4DA0303D2C	Backdoor.Trojan [Symantec] Trojan.Win32.Agent.dckl [Kaspersky Lab] BackDoor-AWQ.b [McAfee] Troj/Oficla-Gen [Sophos] Trojan:Win32/Oficla.E [Microsoft] Win-Trojan/Agent.25089.C [AhnLab]
2	[file and pathname of the sample #1]	18,944 bytes	MD5: 0xEEC53E2239800E5D85B6B85D5E2451CB SHA-1: 0x62FC2EA484ABC6ECF11381727A2FF776A14C60B6	Trojan.Dropper [Symantec] Trojan.Win32.Sasfis.vbw [Kaspersky Lab] Generic Dropper.mx [McAfee] Mal/EncPk-LP [Sophos] Trojan:Win32/Oficla.E [Microsoft] Trojan.Win32.Sasfis [Ikarus] Win-Trojan/Malware.18944.J [AhnLab]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

• The following Registry Key was created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\idid

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\idid]
• url0 = F8 9B 20 62 FC 48 D0 6E 7C A3 56 A1 C5 00 B6 23 A7 C1 6D 23 E9 0B 96 32 35 FF 08 FF DA 56 FA 3F E0 87 24 12 39 FB 14 58 B3 20 6B 9C 56 63 04 23

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
• Shell =

Other details

• There was registered attempt to establish connection with the remote host. The connection details are:

• The data identified by the following URL was then requested from the remote web server:
• http://193.104.27.91/limpopo/bb.php?id=653227819&v=200&tm=2&b=4316315581