ThreatExpert Report

Submission Summary:

Submission details:

Submission received: 19 July 2012, 08:15:52
Processing time: 10 min 4 sec
Submitted sample:

File MD5: 0xFF1CD21044F1659728480A5BFF1D8AA9
File SHA-1: 0xB0AC1E5FC9D9A5F8D10A6ED11183929B7F297C7B
Filesize: 20,928 bytes

Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Creates a startup registry entry.

Technical Details:

File System Modifications

The following file was created in the system:

#	Filename(s)	File Size	File Hash
1	%UserProfile%\62rr45s6xr.exe [file and pathname of the sample #1]	20,928 bytes	MD5: 0xFF1CD21044F1659728480A5BFF1D8AA9 SHA-1: 0xB0AC1E5FC9D9A5F8D10A6ED11183929B7F297C7B

Note:

%UserProfile% is a variable that specifies the current user's profile folder. By default, this is C:\Documents and Settings\[UserName] (Windows NT/2000/XP).

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	36,864 bytes
62rr45s6xr.exe	%UserProfile%\62rr45s6xr.exe	36,864 bytes

Registry Modifications

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

Regedit32 = "%System%\regedit.exe"

[HKEY_CURRENT_USER\Software\Microsoft]

OSVersion = "1642928"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion]

62rr45s6xr = 56 6F EA 70 E0 FD 8D 4D A4 C4 E2 50 D3 29 22 3B

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

62rr45s6xr = "%UserProfile%\62rr45s6xr.exe"

so that 62rr45s6xr.exe runs every time Windows starts

Other details

There were registered attempts to establish connection with the remote hosts. The connection details are:

Remote Host	Port Number
119.81.1.161	443
119.81.1.162	443
78.46.87.164	443
178.63.56.185	25

Outbound traffic (potentially malicious)

There was an outbound traffic produced on port 443:

00000000 | 1603 0000 3701 0000 3303 0002 505B 1D55 | ....7...3...P[.U
00000010 | 02D3 FE99 BC02 1302 4782 286E CB6B 78AA | ........G.(n.kx.
00000020 | 0606 8C32 4B0F 649B 8603 6B0A 3B1C C117 | ...2K.d...k.;...
00000030 | B24C EB2C 6C12 9093 2092 2DC3 0873 15F9 | .L.,l... .-..s..
00000040 | BBB5 CFC7 ABD0 42A3 923F B460 9436 341B | ......B..?.`.64.
00000050 | 499C 55E3 A7D8 D421 0992 5A69 7C28 DFAB | I.U....!..Zi|(..
00000060 | 93D4 C613 4636 E2BC 9B78 2275 F2A9 AFB6 | ....F6...x"u....
00000070 | E19A A2E7 C374 06F9 3091 8056 0D11 8B6E | .....t..0..V...n
00000080 | 8651 9372 5F97 A6B1 2700 8824 C58E AE12 | .Q.r_...'..$....
00000090 | 6010 890B EDDC BAE6 94E9 071B 6AA0 F2D9 | `...........j...
000000A0 | F905 08AD 5AC1 DE21 B4DC 8BE3 ECB5 D08A | ....Z..!........
000000B0 | 1E78 B04F C829 0F6B 1747 4477 96D7 5AB9 | .x.O.).k.GDw..Z.
000000C0 | 3152 D092 217F D681 4916 5BE5 EAD6 7FE4 | 1R..!...I.[.....
000000D0 | 8378 A20C 59AC A749 9DD9 EB8E 7970 85FF | .x..Y..I....yp..
000000E0 | DA31 238C 42DF 9E23 7D8E 559F E594 B770 | .1#.B..#}.U....p
000000F0 | 52CA 2C4E 8C19 3E0C 5A13 2D02 0200      | R.,N..>.Z.-...

There was an outbound traffic produced on port 25:

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.