ThreatExpert Report: TrojanDropper:Win32/Rooter.B, Trojan-Clicker.Win32.Klik..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 11 November 2008, 08:26:30
Processing time: 6 min 25 sec
Submitted sample:

File MD5: 0xAE8AA1DB062E24615FC3829D74A4FA07
File SHA-1: 0xCA50812A6EE0A91F144744BE7865BEF0D5BF9F70
Filesize: 194,560 bytes
Alias:

TrojanDropper:Win32/Rooter.B [Microsoft]
Trojan-Clicker.Win32.Klik [Ikarus]

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\60325cahp25ca0.exe	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)
2	%Temp%\filemrs.exe	176,128 bytes	MD5: 0x1C2A7FB34A7ECCF79FD5DEBAC4124B21 SHA-1: 0xB203A5317EC7DF60B1DF7368776574842D74A0B4	(not available)
3	%Temp%\load.exe	9,728 bytes	MD5: 0x9D3E6E48807591A00E3E28B545B6A91A SHA-1: 0x39C08460E465CF17A9CE653A254753D245F0BF57	TrojanDropper:Win32/Agent.UM [Microsoft] Trojan-Clicker.Win32.Klik [Ikarus]
4	[file and pathname of the sample #1]	194,560 bytes	MD5: 0xAE8AA1DB062E24615FC3829D74A4FA07 SHA-1: 0xCA50812A6EE0A91F144744BE7865BEF0D5BF9F70	TrojanDropper:Win32/Rooter.B [Microsoft] Trojan-Clicker.Win32.Klik [Ikarus]

Note:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
load.exe	%Temp%\load.exe	5,283,840 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	225,280 bytes
filemrs.exe	%Temp%\filemrs.exe	315,392 bytes

Other details

To mark the presence in the system, the following Mutex object was created:

KranYooodN

The following Internet Connection was established:

Server Name	Server Port	Connect as User	Connection Password
bestlocatehomes.com	80	(null)	(null)

The following GET request was made:

robo/robo.php?r=1

The following Internet download was started (the retrieved bits are saved into the local file):

URL to be downloaded	Filename for the downloaded bits
http://bestlocatehomes.com/robo/robo.php?r=4	%Temp%\60325cahp25ca1.exe

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.