Submission Summary:

• Submission details:
• Submission received: 30 August 2008, 14:34:12
• Processing time: 4 min 57 sec
• Submitted sample:
• File MD5: 0x28922C1F972E3A91790F4A5D60655EAB
• File SHA-1: 0xE77C52A807D2A638C6A89D49FBF82CA0FDCD848A
• Filesize: 72,389 bytes
• Alias:
• Backdoor.Bifrost.B [PCTools]
• Backdoor.Bifrose [Symantec]
• Backdoor.Win32.Bifrose.uw [Kaspersky Lab]
• BackDoor-CEP [McAfee]
• BKDR_BIFROSE.A [Trend Micro]
• Troj/Agent-GDP [Sophos]
• Backdoor:Win32/Bifrose [Microsoft]

• Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Backdoor.Bifrose	Backdoor.Bifrose is a backdoor trojan that attempts to propagate by exploiting local network shares. It will also attempt to join a predefined IRC server and channel in order to participate in DDoS attacks.
Trojan.Generic	Common Components that may be used by Trojans Small, DRSN Search, Binet, Euniverse, Adrotator and Dloader among others.
Backdoor.Common_Components_for_Backdoor.Bifrose	These are common components used by Backdoor.Bifrose variants and Backdoor.Viking.

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%System%\plugin1.dat	51,733 bytes	MD5: 0xA76859DB6792F4EEA9B81C12D8C23619 SHA-1: 0xDE0539F1C1524E375C3D976559CE8EEABFD8772E	(not available)
2	[file and pathname of the sample #1] %System%\server.exe	72,389 bytes	MD5: 0x28922C1F972E3A91790F4A5D60655EAB SHA-1: 0xE77C52A807D2A638C6A89D49FBF82CA0FDCD848A	Backdoor.Bifrost.B [PCTools] Backdoor.Bifrose [Symantec] Backdoor.Win32.Bifrose.uw [Kaspersky Lab] BackDoor-CEP [McAfee] BKDR_BIFROSE.A [Trend Micro] Troj/Agent-GDP [Sophos] Backdoor:Win32/Bifrose [Microsoft]
3	%System%\SysPr.prx	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)

• Note:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
server.exe	%System%\server.exe	61,440 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	61,440 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9B71D88C-C598-4935-C5D1-43AA4DB90836}
• HKEY_LOCAL_MACHINE\SOFTWARE\Wget
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideo
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
• HKEY_CURRENT_USER\Software\Wget

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9B71D88C-C598-4935-C5D1-43AA4DB90836}]
• stubpath = "%System%\server.exe s"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• startkey = "%System%\server.exe"

so that server.exe runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SOFTWARE\Wget]
• nck = E7 1D 40 54 22 5E 59 60 B4 3C 2A 5E 33 34 72 00 A3 78 26 35 57 32 2D 60 B4 3C 2A 5E 33 34 72 00
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• startkey = "%System%\server.exe"

so that server.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Wget]
• klg = 01
• plg1 = E0 42 7A 62 1E 7C 69 2F E3 6F 76 2D 4A 47 06 65 CE 4B 14 69 27 5E 58 07 DD 52 1B 70 57 55 06 00 A3 6C 26 23 55 12 D7 72 B4 3C 2A 5E 33 7C 50 24 A3 35 26 66 57 64 2D 23 B4 6E 2A 0A 33 1A 72 64 A3 14 26 59 57 32 2D 72 B4 48 EB C9 4F 7B 29 91 DF 38 26 3

Other details

• The following Host Name was requested from a host database:
• hacker.ipaddress.com

• There was registered attempt to establish connection with the remote host. The connection details are:

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 2000: