Submission Summary:

• Submission details:
• Submission received: 2 May 2010, 12:43:22
• Processing time: 9 min 30 sec
• Submitted sample:
• File MD5: 0xEF2B41B0149492FD0DE3E84E47F7A188
• File SHA-1: 0x64A662661DD2E0A49B50E324A5C799A5EF39EB3E
• Filesize: 417,672 bytes

• Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Backdoor.Bifrose	Backdoor.Bifrose is a backdoor trojan that attempts to propagate by exploiting local network shares. It will also attempt to join a predefined IRC server and channel in order to participate in DDoS attacks.
Backdoor.Litmus	Backdoor.Litmus attempts to create backdoors and allows unauthorized access to an infected machine.

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\addons.dat	24,851 bytes	MD5: 0x5478C24F10D5637F95C003B07404258C SHA-1: 0x80E017058552F73241BE347931A52CCE5627C129	(not available)
2	%AppData%\Bifrost\logg.dat	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)
3	%AppData%\Xenocode\Sandbox\1.0.0.0\2010.04.23T14.13\Virtual\STUBEXE\@SYSTEM@\rad pic.exe	17,408 bytes	MD5: 0x4927DDBB60DB41B4B6FE90540C5AE7BB SHA-1: 0x3626A815C0C8039361BAF12A6D4FC3A1D06676DF	Backdoor.Trojan [PCTools] Backdoor.Trojan [Symantec] Generic.dx!nkg [McAfee]
4	%AppData%\Xenocode\Sandbox\1.0.0.0\2010.04.23T14.13\Virtual\XRegistry.bin	177 bytes	MD5: 0xA2B4A756E7ACF005F346424C059A9A53 SHA-1: 0xD3C7FCA745FFC4BF5396066CC77E5B5D257230D7	(not available)
5	[file and pathname of the sample #1]	417,672 bytes	MD5: 0xEF2B41B0149492FD0DE3E84E47F7A188 SHA-1: 0x64A662661DD2E0A49B50E324A5C799A5EF39EB3E	(not available)

• Note:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

• The following directories were created:
• %AppData%\Bifrost
• %AppData%\Xenocode
• %AppData%\Xenocode\Sandbox
• %AppData%\Xenocode\Sandbox\1.0.0.0
• %AppData%\Xenocode\Sandbox\1.0.0.0\2010.04.23T14.13
• %AppData%\Xenocode\Sandbox\1.0.0.0\2010.04.23T14.13\Virtual
• %AppData%\Xenocode\Sandbox\1.0.0.0\2010.04.23T14.13\Virtual\STUBEXE
• %AppData%\Xenocode\Sandbox\1.0.0.0\2010.04.23T14.13\Virtual\STUBEXE\@SYSTEM@
• %ProgramFiles%\Bifrost

• Notes:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

Memory Modifications

• There were new processes created in the system:

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• Attention! The following process was intentionally hidden from the user:

Process Name	Main Module Size
IEXPLORE.EXE	102,400 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{567739B9-616B-EFBC-B254-6597C459536B}
• HKEY_LOCAL_MACHINE\SOFTWARE\Bifrost
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideo
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
• HKEY_CURRENT_USER\Software\Bifrost
• HKEY_CURRENT_USER\Software\Xenocode
• HKEY_CURRENT_USER\Software\Xenocode\SandboxCache
• HKEY_CURRENT_USER\Software\Xenocode\SandboxCache\351D96ED

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{567739B9-616B-EFBC-B254-6597C459536B}]
• stubpath = "%AppData%\Bifrost\server.exe s"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Bifrost]
• nck = ED 1B E6 27 B9 28 D6 32 74 C3 CD 74 FA 93 5B 67
• [HKEY_CURRENT_USER\Software\Bifrost]
• klg = 01
• plg1 = EA 44 DC 02 A3 27 D7 5F 11 AD B9 07 DA F2 35 03 2A 35 8E 58 1B 0E 11 94 D4 F9 28 1F 11 4D 98 BC D2 64 44 8E CD F9 B9 BA 23 BD 45 ED 15 A6 77 AF B8 7C 04 4D 90 91 58 5F 81 61 19 72 00 4E 53 7A E0 AB 66 8B 04 DC 34 56 BC 15 2D 84 A9 B3 1D F6 6C 09 21 6

Other details

• To mark the presence in the system, the following Mutex objects were created:
• Bif1234
• _xvm_mtx_file_0x351D96ED
• _xvm_mtx_reg_0x351D96ED
• _xvm_mtx_other_0x351D96ED

• The following Host Name was requested from a host database:
• 10.8.52.84

• There was registered attempt to establish connection with the remote host. The connection details are:

• There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:
• %ProgramFiles%\Internet Explorer\iexplore.exe

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 1955: