Submission Summary:

• Submission details:
• Submission received: 8 September 2009, 03:53:44
• Processing time: 8 min 17 sec
• Submitted sample:
• File MD5: 0x0AA203943D1E264973B2993CA09EF4C3
• File SHA-1: 0xCA973B0E458F0E0CCA13636BD88784B80CCAE24D
• Filesize: 449,024 bytes
• Alias:
• W32.Ackantta@mm [Symantec]
• Email-Worm.Win32.Agent.gew [Kaspersky Lab]
• W32/Xirtem@MM [McAfee]
• W32/Autorun-RI [Sophos]
• Worm:Win32/Prolaco.A@mm [Microsoft]
• Email-Worm.Win32.Agent [Ikarus]
• Win32/Ceein.worm.449024 [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Capability to send out email message(s) with the built-in SMTP client engine.
Communication with a remote SMTP server and sending out email.
Mass-mailer that sends out email to the email addresses harvested from the local computer.
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Trojan.Agent.ASDJ	Trojan.Agent.ASDJ runs in the background and allows remote intruders to gain access and control over the computer. It might also download other malware onto the infected computer. The threat is capable of logging keystrokes.

• Attention! The following threat categories were identified:

Threat Category	Description
	A network-aware worm that attempts to replicate across the existing network(s)
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%System%\qnx.exe	157,184 bytes	MD5: 0xF596B22087D6404D538825413E266131 SHA-1: 0xCE76C13EFEA521B321C6C32270D272B1A7D7241A	W32.Ackantta@mm [Symantec] Trojan.Win32.Agent.asdj [Kaspersky Lab] Generic Dropper.ea [McAfee] W32/Autorun-RI [Sophos] VirTool:Win32/Injector.gen!AH [Microsoft] VirTool.Win32.CeeInject [Ikarus] Win32/Ceein.worm.157184 [AhnLab]
2	[file and pathname of the sample #1] %System%\vxworks.exe	449,024 bytes	MD5: 0x0AA203943D1E264973B2993CA09EF4C3 SHA-1: 0xCA973B0E458F0E0CCA13636BD88784B80CCAE24D	W32.Ackantta@mm [Symantec] Email-Worm.Win32.Agent.gew [Kaspersky Lab] W32/Xirtem@MM [McAfee] W32/Autorun-RI [Sophos] Worm:Win32/Prolaco.A@mm [Microsoft] Email-Worm.Win32.Agent [Ikarus] Win32/Ceein.worm.449024 [AhnLab]

• Note:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	438,272 bytes
vxworks.exe	%System%\vxworks.exe	438,272 bytes
qnx.exe	%System%\qnx.exe	172,032 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Wallpaper
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Wallpaper\XMAS
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• Wind River Systems = "%System%\vxworks.exe"

so that vxworks.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download]
• CheckExeSignatures = 0x00000001
• RunInvalidSignatures = "no"
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations]
• LowRiskFileTypes = ".zip;.rar;.cab;.txt;.exe;.reg;.msi;.htm;.html;.bat;.cmd;.pif;.scr;.mov;.mp3;.wav"

• The following Registry Value was deleted:
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download]
• CheckExeSignatures = "yes"

Other details

• To mark the presence in the system, the following Mutex objects were created:
• Y_aKS~pXq
• 1C_O0nAp

• The following ports were open in the system:

• The following Host Names were requested from a host database:
• www.whatismyip.com
• mail.[user's domain]
• [user's email address]
• 206.137.17.89

• There was registered attempt to establish connection with the remote host. The connection details are:

• The following Internet Connection was established:

• The following GET requests were made:
• images/global_splash/arch.jpg
• images/global_splash/imgoingto.jpg
• images/spacer.gif

• The following HTTP URL was started reading:
• http://whatismyip.com/automation/n09230945.asp

Generated SMTP traffic

• Email Senders:
• noreply@coca-cola.com
• postcards@hallmark.com
• giveaway@mcdonalds.com

• Email Recipient:
• [user's email address]

• Email Subjects:
• Coca Cola is proud to accounce our new Christmas Promotion.
• You've received A Hallmark E-Card!
• Mcdonalds wishes you Merry Christmas!

• Email Attachments:
• promotion.zip (614,624 bytes)
• postcard.zip (614,624 bytes)
• coupon.zip (614,616 bytes)
• coupon.zip (614,822 bytes)

• Email Body:

• For example, the generated email message may look similar to the one shown below: