Submission Summary:

• Submission details:
• Submission received: 17 August 2012, 11:13:31
• Processing time: 7 min 46 sec
• Submitted sample:
• File MD5: 0xF95FDEC8431C3DB7D5A5AA5A72F50D27
• File SHA-1: 0xF2C68C9E3D77061E09BDF8AD05638F5BC1F0A40F
• Filesize: 4,367,872 bytes
• Alias:
• Infostealer.Bancos [Symantec]
• Trojan-Banker.Win32.Banker.fru [Kaspersky Lab]
• PWS-Banker.gen.i [McAfee]
• Mal/Behav-285 [Sophos]
• TrojanSpy:Win32/Banker [Microsoft]
• BehavesLikeWin32.ExplorerHijack [Ikarus]
• Win-Trojan/Banker.4367872 [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Is protected with Themida in order to prevent the sample from being reverse-engineered. Themida protection can potentially be used by a threat to complicate the manual threat analysis (e.g. the sample would not run under the Virtual Machine).
Capability to send out email message(s) with the built-in SMTP client engine.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Trojan-Spy.Banker!ct	Trojan-Spy.Banker!ct is a malicious application that attempts to steal passwords, login details, and other confidential information

• Attention! The following threat category was identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%CommonPrograms%\Startup\Windows32.exe [file and pathname of the sample #1]	4,367,872 bytes	MD5: 0xF95FDEC8431C3DB7D5A5AA5A72F50D27 SHA-1: 0xF2C68C9E3D77061E09BDF8AD05638F5BC1F0A40F	Infostealer.Bancos [Symantec] Trojan-Banker.Win32.Banker.fru [Kaspersky Lab] PWS-Banker.gen.i [McAfee] Mal/Behav-285 [Sophos] TrojanSpy:Win32/Banker [Microsoft] BehavesLikeWin32.ExplorerHijack [Ikarus] Win-Trojan/Banker.4367872 [AhnLab]
2	%Windir%\system\Logfile.txt	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)
3	%Windir%\winload.inf	5 bytes	MD5: 0xF1DDF92DC6A9E07496ED7915A9AA50E8 SHA-1: 0xF68791AD8666902577BFEC3FE5FC86F235FE938D	(not available)

• Notes:
• %CommonPrograms% is a variable that refers to the file system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\Documents and Settings\All Users\Start Menu\Programs (Windows NT/2000/XP).
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• Windows32 = "C:\Arquivos de programas\Windows32.exe"

so that Windows32.exe runs every time Windows starts

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Brazil

• To mark the presence in the system, the following Mutex object was created:
• .