Submission Summary:

Submission details:

Submission received: 18 March 2009, 12:32:24 AM

Processing time: 4 min 53 sec

Submitted sample:

File MD5: 0xFBCE76A95B969BD1C1C8BD2EB7013DF8

Filesize: 1,266,692 bytes

Technical Details:

Possible Security Risk

Attention! The following threat category was identified:

Threat Category

Description

A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

The following files were created in the system:

#

Filename(s)

File Size

File MD5

1

[file and pathname of the sample #1]

1,266,692 bytes

0xFBCE76A95B969BD1C1C8BD2EB7013DF8

2

%Windir%\Winend\hex.exe

32,768 bytes

0xC57FCA3B87D91FE243214332367EB1B8

3

%Windir%\Winend\mirc.exe

2,076,672 bytes

0x52F9F2101923E84DD146FD1058D97B60

4

%Windir%\Winend\mirc.ini

3,035 bytes

0xC10BC7F3AF9222C9CAB30110DBFB7483

5

%Windir%\Winend\remote.ini

174 bytes

0xE89B0B0AE17EC5624B6A945598FEF984

6

%Windir%\Winend\scan.dll

9,993 bytes

0x4C9B6FFC945F63E4EE8447C856787AAA

7

%Windir%\Winend\script.dll

17,347 bytes

0x4EB13AB37482DB29175953483CB01E43

8

%Windir%\Winend\script.ini

84 bytes

0xED5358007DD611A02A997CB6A4DBFE23

9

%Windir%\Winend\serv.dll

23 bytes

0xBF363A16341395914AF5698D11AFD788

10

%Windir%\Winend\servers.ini

66 bytes

0xB8B5BE8877AA4CCF0954CF07F995BC2E

The following directories were created:

%Windir%\Winend

%Windir%\Winend\channels

%Windir%\Winend\cmd

%Windir%\Winend\download

%Windir%\Winend\logs

%Windir%\Winend\sounds

Memory Modifications

There were new processes created in the system:

Process Name

Process Filename

Main Module Size

hex.exe

%Windir%\winend\hex.exe

40,960 bytes

setup.exe

%Temp%\ae26413\setup.exe

462,848 bytes

[filename of the sample #1]

[file and pathname of the sample #1]

65,536 bytes

Note:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mIRC

HKEY_CURRENT_USER\Software\Microsoft\Microsoft Agent

HKEY_CURRENT_USER\Software\Classes\.cha

HKEY_CURRENT_USER\Software\Classes\.chat

HKEY_CURRENT_USER\Software\Classes\ChatFile

HKEY_CURRENT_USER\Software\Classes\ChatFile\DefaultIcon

HKEY_CURRENT_USER\Software\Classes\ChatFile\Shell

HKEY_CURRENT_USER\Software\Classes\ChatFile\Shell\open

HKEY_CURRENT_USER\Software\Classes\ChatFile\Shell\open\command

HKEY_CURRENT_USER\Software\Classes\ChatFile\Shell\open\ddeexec

HKEY_CURRENT_USER\Software\Classes\ChatFile\Shell\open\ddeexec\Application

HKEY_CURRENT_USER\Software\Classes\ChatFile\Shell\open\ddeexec\ifexec

HKEY_CURRENT_USER\Software\Classes\ChatFile\Shell\open\ddeexec\Topic

HKEY_CURRENT_USER\Software\Classes\irc

HKEY_CURRENT_USER\Software\Classes\irc\DefaultIcon

HKEY_CURRENT_USER\Software\Classes\irc\Shell

HKEY_CURRENT_USER\Software\Classes\irc\Shell\open

HKEY_CURRENT_USER\Software\Classes\irc\Shell\open\command

HKEY_CURRENT_USER\Software\Classes\irc\Shell\open\ddeexec

HKEY_CURRENT_USER\Software\Classes\irc\Shell\open\ddeexec\Application

HKEY_CURRENT_USER\Software\Classes\irc\Shell\open\ddeexec\ifexec

HKEY_CURRENT_USER\Software\Classes\irc\Shell\open\ddeexec\Topic

HKEY_CURRENT_USER\Software\mIRC

HKEY_CURRENT_USER\Software\mIRC\LastRun

HKEY_CURRENT_USER\Software\mIRC\License

HKEY_CURRENT_USER\Software\mIRC\%UserName%

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

mirc = "%Windir%\Winend\mirc.exe"

so that mirc.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mIRC]

DisplayIcon = "%Windir%\winend\mirc.exe"

DisplayName = "mIRC"

DisplayVersion = "6.21"

Publisher = "mIRC Co. Ltd."

UninstallString = ""%Windir%\winend\mirc.exe" -uninstall"

URLUpdateInfo = "http://www.mirc.com"

[HKEY_CURRENT_USER\Software\Microsoft\Microsoft Agent]

VoiceEnabled = 0x00000001

UseVoiceTips = 0x00000001

KeyHoldHotKey = 0x00000091

UseBeepSRPrompt = 0x00000001

SRTimerDelay = 0x000007D0

SRModeID = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

EnableSpeaking = 0x00000001

UseBalloon = 0x00000001

UseCharacterFont = 0x00000001

UseSoundEffects = 0x00000001

SpeakingSpeed = 0x00000005

PropertySheetX = 0x000F423F

PropertySheetY = 0x000F423F

PropertySheetWidth = 0x00000000

PropertySheetHeight = 0x00000000

PropertySheetPage = 0x00000000

CommandsWindowLeft = 0xFFFFFFFF

CommandsWindowTop = 0xFFFFFFFF

CommandsWindowWidth = 0x000000C8

CommandsWindowHeight = 0x000000C8

CommandsWindowLocationSet = 0x00000000

[HKEY_CURRENT_USER\Software\Classes\.cha]

(Default) = "ChatFile"

[HKEY_CURRENT_USER\Software\Classes\.chat]

(Default) = "ChatFile"

[HKEY_CURRENT_USER\Software\Classes\ChatFile\Shell\open\ddeexec\Topic]

(Default) = "Connect"

[HKEY_CURRENT_USER\Software\Classes\ChatFile\Shell\open\ddeexec\ifexec]

(Default) = "%1"

[HKEY_CURRENT_USER\Software\Classes\ChatFile\Shell\open\ddeexec\Application]

(Default) = "mIRC"

[HKEY_CURRENT_USER\Software\Classes\ChatFile\Shell\open\ddeexec]

(Default) = "%1"

[HKEY_CURRENT_USER\Software\Classes\ChatFile\Shell\open\command]

(Default) = ""%Windir%\winend\mirc.exe" -noconnect"

[HKEY_CURRENT_USER\Software\Classes\ChatFile\DefaultIcon]

(Default) = ""%Windir%\winend\mirc.exe""

[HKEY_CURRENT_USER\Software\Classes\ChatFile]

(Default) = "Chat File"

[HKEY_CURRENT_USER\Software\Classes\irc\Shell\open\ddeexec\Topic]

(Default) = "Connect"

[HKEY_CURRENT_USER\Software\Classes\irc\Shell\open\ddeexec\ifexec]

(Default) = "%1"

[HKEY_CURRENT_USER\Software\Classes\irc\Shell\open\ddeexec\Application]

(Default) = "mIRC"

[HKEY_CURRENT_USER\Software\Classes\irc\Shell\open\ddeexec]

(Default) = "%1"

[HKEY_CURRENT_USER\Software\Classes\irc\Shell\open\command]

(Default) = ""%Windir%\winend\mirc.exe" -noconnect"

[HKEY_CURRENT_USER\Software\Classes\irc\DefaultIcon]

(Default) = ""%Windir%\winend\mirc.exe""

[HKEY_CURRENT_USER\Software\Classes\irc]

(Default) = "URL:IRC Protocol"

EditFlags = 02 00 00 00

URL Protocol = ""

[HKEY_CURRENT_USER\Software\mIRC\%UserName%]

(Default) = "User"

[HKEY_CURRENT_USER\Software\mIRC\License]

(Default) = "1254-126654"

[HKEY_CURRENT_USER\Software\mIRC\LastRun]

(Default) = "1237365180,0"

Other details

Analysis of the file resources indicate the following possible country of origin:

United Kingdom

The following Host Name was requested from a host database:

irc.OfficialBadBoyZ.net

There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:

%Windir%\Winend\mirc.exe

Outbound traffic

Attention! There was a new connection established with a remote IRC Server. The generated outbound IRC traffic is provided below:

NICK igducck
USER XServices "" "irc.OfficialBadBoyZ.net" :User
USERHOST igducck
NICK :[OBB][XBOT]-0759676
JOIN #[X][OBB]
MODE igducck +i
NOTICE igducckUSER :.VERSION mIRC v6.21 Khaled Mardam-Bey.
WHOIS igducckUSER

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.

Copyright © 2009 ThreatExpert. All rights reserved.