Submission Summary:

• Submission details:
• Submission received: 8 August 2012, 01:23:19
• Processing time: 13 min 28 sec
• Submitted sample:
• File MD5: 0xF35CEC3EACC50D65DA694D4A78915A23
• File SHA-1: 0xC9E64BF495A16056B9B4D84B13E7CF662580F0D2
• Filesize: 674,304 bytes
• Alias:
• Generic BackDoor.xa [McAfee]
• Mal/Behav-058 [Sophos]
• Trojan.Win32.CDur [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Creates a startup registry entry.

Technical Details:

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\MSDCSC\msdcsc.exe [file and pathname of the sample #1]	674,304 bytes	MD5: 0xF35CEC3EACC50D65DA694D4A78915A23 SHA-1: 0xC9E64BF495A16056B9B4D84B13E7CF662580F0D2	Generic BackDoor.xa [McAfee] Mal/Behav-058 [Sophos] Trojan.Win32.CDur [Ikarus]

• The following directories were created:
• %AppData%\dclogs
• c:\MSDCSC

• Note:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\Software\DC3_FEXEC

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• MicroUpdate = "C:\MSDCSC\msdcsc.exe"

so that msdcsc.exe runs every time Windows starts

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
• Userinit =

Other details

• Analysis of the file resources indicate the following possible country of origin:

	France

• To mark the presence in the system, the following Mutex object was created:
• DC_MUTEX-GY2H3ER

• The following Host Name was requested from a host database:
• ersg2013.zapto.org

• There was registered attempt to establish connection with the remote host. The connection details are:

• There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:
• c:\msdcsc\msdcsc.exe

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 28: