Submission Summary:

• Submission details:
• Submission received: 3 November 2009, 16:03:15
• Processing time: 5 min 51 sec
• Submitted sample:
• File MD5: 0xF0C2C96212C59121431CEDF412C52140
• File SHA-1: 0x7434E7CED190B693BF26C1BAFDD707D9BF068DE3
• Filesize: 169,171 bytes
• Alias:
• Trojan Horse [Symantec]
• Backdoor.Win32.Prorat.eey [Kaspersky Lab]
• Mal/Generic-A [Sophos]
• Win-Trojan/Prorat.169171 [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Communication with a remote IRC server.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

• The new window was created, as shown below:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Trojan-PSW.Agent!sd6	Trojan-PSW.Agent!sd6 is a malicious application that attempts to steal passwords, login details, and other confidential information.
Backdoor.Senik	Backdoor.Senik runs silently in the background as a process which starts up with Windows. It will open up a port to listen for commands from attackers which allows them to gain access and control of the infected machine.

• Attention! The following threat categories were identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\system009z.exe	10,240 bytes	MD5: 0xF5DE7CE14BCF5F9F3B6E867418B402AA SHA-1: 0x90F6D86F318E4E03D42D8DB85E4BEC38921BE74B	Infostealer [Symantec] Trojan-PSW.Win32.Agent.mii [Kaspersky Lab] Mal/Autorun-TR, Mal/Emogen-U [Sophos] Trojan-PWS.Win32.Agent [Ikarus] Win-Trojan/Agent.10240.XM [AhnLab] packed with PE_Patch.UPX [Kaspersky Lab]
2	%Temp%\Vista_Activation_Crack.exe %Windir%\win32.exe	37,376 bytes	MD5: 0x44B4553FEB8C0B5A524CAAD9F0DBC4DC SHA-1: 0x573C5B114DC44D6E7B8C531D77BF38CCC237B56F	Trojan Horse [Symantec] Trojan.Win32.Agent.buag [Kaspersky Lab] Troj/Agent-JRN [Sophos] Virus.Win32.Inject [Ikarus] Win-Trojan/Agent.11776.KS [AhnLab]
3	[file and pathname of the sample #1]	169,171 bytes	MD5: 0xF0C2C96212C59121431CEDF412C52140 SHA-1: 0x7434E7CED190B693BF26C1BAFDD707D9BF068DE3	Trojan Horse [Symantec] Backdoor.Win32.Prorat.eey [Kaspersky Lab] Mal/Generic-A [Sophos] Win-Trojan/Prorat.169171 [AhnLab]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
Vista_Activation_Crack.exe	%Temp%\vista_activation_crack.exe	307,200 bytes
win32.exe	%Windir%\win32.exe	307,200 bytes

Registry Modifications

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• Windows UDP Control Center = "win32.exe"

so that win32.exe runs every time Windows starts