ThreatExpert Report: MonitoringTool, not-a-virus:RemoteAdmin.Win32.eSurveiller.120, Infostealer..

Submission Summary:

Submission details:

Submission received: 3 August 2012, 15:27:18
Processing time: 9 min 33 sec
Submitted sample:

File MD5: 0x1092C39537473DDC6FD20531B0D4987A
File SHA-1: 0x404356C3C6FB88BB28883AB98AC779A7DC25CB27
Filesize: 1,451,967 bytes
Alias: MonitoringTool [Ikarus]

Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! The following threat category was identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	[file and pathname of the sample #1]	1,451,967 bytes	MD5: 0x1092C39537473DDC6FD20531B0D4987A SHA-1: 0x404356C3C6FB88BB28883AB98AC779A7DC25CB27	not-a-virus:RemoteAdmin.Win32.eSurveiller.120 [Kaspersky Lab] MonitoringTool [Ikarus]
2	%System%\tcphost.exe	644,096 bytes	MD5: 0x55EED365A34F99397F3280AF267BF60F SHA-1: 0x6CDA35CAEBC04AAF46608C56003BFE7A0C32B31E	Infostealer [Symantec] not-a-virus:RemoteAdmin.Win32.eSurveiller.120 [Kaspersky Lab] RemAdm-ESurveiller [McAfee] MonitoringTool:Win32/ESurveiller [Microsoft] not-a-virus:Monitor.Win32.007SpySoft.308 [Ikarus]
3	%System%\tcphost.ini	421 bytes	MD5: 0x2FCDA2AFC8128D294A0F89E3945E4E4C SHA-1: 0xFC72910F402C6520800A0C6FF649F3F981652F61	(not available)
4	%System%\tcphost.tmp	19 bytes	MD5: 0xC2DCB86B6D6FCE014001F352634C9F87 SHA-1: 0xD6CCD441A0ACB0CCFC39C22053C31A94C85C9DCD	(not available)
5	%System%\zlib.dll	53,248 bytes	MD5: 0x4965107D112666D3835308A831A29274 SHA-1: 0x50439B99CE525ECB74C554E1DC43DDB39481DFA4	(not available)

Note:

%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following directory was created:

%AppData%\Microsoft\System

Notes:

%AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
tcphost.exe	%System%\tcphost.exe	671,744 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	73,728 bytes
install.exe	%Temp%\install.exe	45,056 bytes

Notes:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Registry Modifications

The following Registry Key was created:

HKEY_CURRENT_USER\Software\Microsoft\Visual Basic\5.0

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

tcphost = "%System%\tcphost.exe"

so that tcphost.exe runs every time Windows starts

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

tcphost = "%System%\tcphost.exe"

so that tcphost.exe runs every time Windows starts

[HKEY_CURRENT_USER\Software\Classes\CLSID\{0000002F-0000-0000-C000-000000000046}\InprocServer32]

(Default) = "oleaut32.dll"

[HKEY_CURRENT_USER\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32]

(Default) = "oleaut32.dll"

[HKEY_CURRENT_USER\Software\Classes\CLSID\{00020421-0000-0000-C000-000000000046}\InprocServer32]

(Default) = "oleaut32.dll"

[HKEY_CURRENT_USER\Software\Classes\CLSID\{00020422-0000-0000-C000-000000000046}\InprocServer32]

(Default) = "oleaut32.dll"

[HKEY_CURRENT_USER\Software\Classes\CLSID\{00020423-0000-0000-C000-000000000046}\InprocServer32]

(Default) = "oleaut32.dll"

[HKEY_CURRENT_USER\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32]

(Default) = "oleaut32.dll"

[HKEY_CURRENT_USER\Software\Classes\CLSID\{00020425-0000-0000-C000-000000000046}\InprocServer32]

(Default) = "oleaut32.dll"

[HKEY_CURRENT_USER\Software\Classes\CLSID\{0BE35203-8F91-11CE-9DE3-00AA004BB851}\InprocServer32]

(Default) = "oleaut32.dll"

[HKEY_CURRENT_USER\Software\Classes\CLSID\{0BE35204-8F91-11CE-9DE3-00AA004BB851}\InprocServer32]

(Default) = "oleaut32.dll"

[HKEY_CURRENT_USER\Software\Classes\CLSID\{46763EE0-CAB2-11CE-8C20-00AA0051E5D4}\InprocServer32]

(Default) = "oleaut32.dll"

[HKEY_CURRENT_USER\Software\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32]

(Default) = "oleaut32.dll"

Other details

Analysis of the file resources indicate the following possible country of origin:

France

The following port was open in the system:

Port	Protocol	Process
1033	TCP	tcphost.exe (%System%\tcphost.exe)

The following Host Name was requested from a host database:

MAXIMOUS

There was registered attempt to establish connection with the remote host. The connection details are:

Remote Host	Port Number
MAXIMOUS	424

Outbound traffic (potentially malicious)

There was an outbound traffic produced on port 424:

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.