ThreatExpert Report: Trojan-GameThief.Win32.Magania.hknh, Mal/FarFli-P, Backdoor:Win32/Farfli.O..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 17 August 2012, 06:07:18
Processing time: 7 min 28 sec
Submitted sample:

File MD5: 0x11797A87077EAFF7EF46C3EAC4A3F176
File SHA-1: 0xBED73F688C3E43C18F6DB44D94DD023613D3BAC1
Filesize: 117,248 bytes
Alias:

Trojan-GameThief.Win32.Magania.hknh [Kaspersky Lab]
Mal/FarFli-P [Sophos]
Backdoor:Win32/Farfli.O [Microsoft]
Backdoor.Win32.Inject [Ikarus]

Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%ProgramFiles%\Xtuv\Dtuvwxyab.jpg [file and pathname of the sample #1]	117,248 bytes	MD5: 0x11797A87077EAFF7EF46C3EAC4A3F176 SHA-1: 0xBED73F688C3E43C18F6DB44D94DD023613D3BAC1	Trojan-GameThief.Win32.Magania.hknh [Kaspersky Lab] Mal/FarFli-P [Sophos] Backdoor:Win32/Farfli.O [Microsoft] Backdoor.Win32.Inject [Ikarus]
2	c:\system32.txt	8,192 bytes	MD5: 0x20FBC6ED3A1B6D89EAA5B981690416E5 SHA-1: 0x0199D90E3064492FE041FEE4AA5AC19BC4FC99AF	(not available)

Note:

%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following directory was created:

%ProgramFiles%\Xtuv

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[generic host process]	[generic host process filename]	20,480 bytes

Notes:

[generic host process filename] is a full path filename of [generic host process].

The following modules were loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
[filename of the sample #1]	[file and pathname of the sample #1]	Process name: [generic host process] Process filename: [generic host process filename] Address space: 0xB50000 - 0xB79000
[filename of the sample #1]	[file and pathname of the sample #1]	Process name: [generic host process] Process filename: [generic host process filename] Address space: 0xB10000 - 0xB39000

There was a new service created in the system:

Service Name	Display Name	Status	Service Filename
Stuvwx Abcdefgh Jkl	Stuvwx Abcdefgh Jklmnopq Stuv	"Starting"	%System%\svchost.exe -k imgsvc

Notes:

%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\113509976
HKEY_LOCAL_MACHINE\SOFTWARE\113509976\DComLaunch
HKEY_LOCAL_MACHINE\SOFTWARE\113509976\HTTPFilter
HKEY_LOCAL_MACHINE\SOFTWARE\113509976\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\113509976\netsvcs
HKEY_LOCAL_MACHINE\SOFTWARE\113509976\PCHealth
HKEY_LOCAL_MACHINE\SOFTWARE\113509976\termsvcs
HKEY_LOCAL_MACHINE\SOFTWARE\175542689
HKEY_LOCAL_MACHINE\SOFTWARE\175542689\DComLaunch
HKEY_LOCAL_MACHINE\SOFTWARE\175542689\HTTPFilter
HKEY_LOCAL_MACHINE\SOFTWARE\175542689\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\175542689\netsvcs
HKEY_LOCAL_MACHINE\SOFTWARE\175542689\PCHealth
HKEY_LOCAL_MACHINE\SOFTWARE\175542689\termsvcs
HKEY_LOCAL_MACHINE\SOFTWARE\255086338
HKEY_LOCAL_MACHINE\SOFTWARE\255086338\Parameters
HKEY_LOCAL_MACHINE\SOFTWARE\255086338\Security
HKEY_LOCAL_MACHINE\SOFTWARE\260752948
HKEY_LOCAL_MACHINE\SOFTWARE\260752948\Parameters
HKEY_LOCAL_MACHINE\SOFTWARE\260752948\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideo
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_STUVWX_ABCDEFGH_JKL
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_STUVWX_ABCDEFGH_JKL\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_STUVWX_ABCDEFGH_JKL\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Stuvwx Abcdefgh Jkl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Stuvwx Abcdefgh Jkl\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Stuvwx Abcdefgh Jkl\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_STUVWX_ABCDEFGH_JKL
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_STUVWX_ABCDEFGH_JKL\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_STUVWX_ABCDEFGH_JKL\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Stuvwx Abcdefgh Jkl
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Stuvwx Abcdefgh Jkl\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Stuvwx Abcdefgh Jkl\Security
HKEY_CURRENT_USER\NetSubKey

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\113509976\termsvcs]

CoInitializeSecurityParam = 0x00000001
DefaultRpcStackSize = 0x00000008

[HKEY_LOCAL_MACHINE\SOFTWARE\113509976\PCHealth]

CoInitializeSecurityParam = 0x00000002
AuthenticationCapabilities = 0x00000040

[HKEY_LOCAL_MACHINE\SOFTWARE\113509976\netsvcs]

CoInitializeSecurityParam = 0x00000001
AuthenticationCapabilities = 0x00003020

[HKEY_LOCAL_MACHINE\SOFTWARE\113509976\LocalService]

CoInitializeSecurityParam = 0x00000001
AuthenticationCapabilities = 0x00002000

[HKEY_LOCAL_MACHINE\SOFTWARE\113509976\HTTPFilter]

CoInitializeSecurityParam = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\113509976\DComLaunch]

CoInitializeSecurityParam = 0x00000001
DefaultRpcStackSize = 0x00000008

[HKEY_LOCAL_MACHINE\SOFTWARE\113509976]

HTTPFilter = "HTTPFilter"
LocalService = "Alerter WebClient LmHosts RemoteRegistry upnphost SSDPSRV"
NetworkService = "DnsCache"
netsvcs = "6to4 AppMgmt AudioSrv Browser CryptSvc DMServer DHCP ERSvc EventSystem FastUserSwitchingCompatibility HidServ Ias Iprip Irmon LanmanServer LanmanWorkstation Messenger Netman Nla Ntmssvc NWCWorkstation Nwsapagent Rasauto Rasman Remoteaccess Schedule
DcomLaunch = "DcomLaunch TermService"
rpcss = "RpcSs"
imgsvc = 53 74 69 53 76 63 00 53 74 75 76 77 78 20 41 62 63 64 65 66 67 68 20 4A 6B 6C 00
termsvcs = "TermService"

[HKEY_LOCAL_MACHINE\SOFTWARE\175542689\termsvcs]

CoInitializeSecurityParam = 0x00000001
DefaultRpcStackSize = 0x00000008

[HKEY_LOCAL_MACHINE\SOFTWARE\175542689\PCHealth]

CoInitializeSecurityParam = 0x00000002
AuthenticationCapabilities = 0x00000040

[HKEY_LOCAL_MACHINE\SOFTWARE\175542689\netsvcs]

CoInitializeSecurityParam = 0x00000001
AuthenticationCapabilities = 0x00003020

[HKEY_LOCAL_MACHINE\SOFTWARE\175542689\LocalService]

CoInitializeSecurityParam = 0x00000001
AuthenticationCapabilities = 0x00002000

[HKEY_LOCAL_MACHINE\SOFTWARE\175542689\HTTPFilter]

CoInitializeSecurityParam = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\175542689\DComLaunch]

CoInitializeSecurityParam = 0x00000001
DefaultRpcStackSize = 0x00000008

[HKEY_LOCAL_MACHINE\SOFTWARE\175542689]

HTTPFilter = "HTTPFilter"
LocalService = "Alerter WebClient LmHosts RemoteRegistry upnphost SSDPSRV"
NetworkService = "DnsCache"
netsvcs = "6to4 AppMgmt AudioSrv Browser CryptSvc DMServer DHCP ERSvc EventSystem FastUserSwitchingCompatibility HidServ Ias Iprip Irmon LanmanServer LanmanWorkstation Messenger Netman Nla Ntmssvc NWCWorkstation Nwsapagent Rasauto Rasman Remoteaccess Schedule
DcomLaunch = "DcomLaunch TermService"
rpcss = "RpcSs"
imgsvc = 53 74 69 53 76 63 00 53 74 75 76 77 78 20 41 62 63 64 65 66 67 68 20 4A 6B 6C 00
termsvcs = "TermService"

[HKEY_LOCAL_MACHINE\SOFTWARE\255086338\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SOFTWARE\255086338\Parameters]

ServiceDll = "%ProgramFiles%\Xtuv\Dtuvwxyab.jpg"

[HKEY_LOCAL_MACHINE\SOFTWARE\255086338]

Type = 0x00000110
Start = 0x00000002
ErrorControl = 0x00000000
ImagePath = "%System%\svchost.exe -k imgsvc"
DisplayName = "Stuvwx Abcdefgh Jklmnopq Stuv"
ObjectName = "LocalSystem"
Description = "Stuvwxya Cdefghijk Mnopqrs Uvwxyabc Efg"

[HKEY_LOCAL_MACHINE\SOFTWARE\260752948\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SOFTWARE\260752948\Parameters]

ServiceDll = "%ProgramFiles%\Xtuv\Dtuvwxyab.jpg"

[HKEY_LOCAL_MACHINE\SOFTWARE\260752948]

Type = 0x00000110
Start = 0x00000002
ErrorControl = 0x00000000
ImagePath = "%System%\svchost.exe -k imgsvc"
DisplayName = "Stuvwx Abcdefgh Jklmnopq Stuv"
ObjectName = "LocalSystem"
Description = "Stuvwxya Cdefghijk Mnopqrs Uvwxyabc Efg"
FailureActions = 80 51 01 00 00 00 00 00 00 00 00 00 03 00 00 00 53 00 65 00 01 00 00 00 E8 03 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_STUVWX_ABCDEFGH_JKL\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "Stuvwx Abcdefgh Jkl"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_STUVWX_ABCDEFGH_JKL\0000]

Service = "Stuvwx Abcdefgh Jkl"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "Stuvwx Abcdefgh Jklmnopq Stuv"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_STUVWX_ABCDEFGH_JKL]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Stuvwx Abcdefgh Jkl\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Stuvwx Abcdefgh Jkl\Parameters]

ServiceDll = "%ProgramFiles%\Xtuv\Dtuvwxyab.jpg"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Stuvwx Abcdefgh Jkl]

Type = 0x00000110
Start = 0x00000002
ErrorControl = 0x00000000
ImagePath = "%System%\svchost.exe -k imgsvc"
DisplayName = "Stuvwx Abcdefgh Jklmnopq Stuv"
ObjectName = "LocalSystem"
Description = "Stuvwxya Cdefghijk Mnopqrs Uvwxyabc Efg"
FailureActions = 80 51 01 00 00 00 00 00 00 00 00 00 03 00 00 00 53 00 65 00 01 00 00 00 E8 03 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_STUVWX_ABCDEFGH_JKL\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "Stuvwx Abcdefgh Jkl"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_STUVWX_ABCDEFGH_JKL\0000]

Service = "Stuvwx Abcdefgh Jkl"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "Stuvwx Abcdefgh Jklmnopq Stuv"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_STUVWX_ABCDEFGH_JKL]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Stuvwx Abcdefgh Jkl\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Stuvwx Abcdefgh Jkl\Parameters]

ServiceDll = "%ProgramFiles%\Xtuv\Dtuvwxyab.jpg"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Stuvwx Abcdefgh Jkl]

Type = 0x00000110
Start = 0x00000002
ErrorControl = 0x00000000
ImagePath = "%System%\svchost.exe -k imgsvc"
DisplayName = "Stuvwx Abcdefgh Jklmnopq Stuv"
ObjectName = "LocalSystem"
Description = "Stuvwxya Cdefghijk Mnopqrs Uvwxyabc Efg"
FailureActions = 80 51 01 00 00 00 00 00 00 00 00 00 03 00 00 00 53 00 65 00 01 00 00 00 E8 03 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]

imgsvc =

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]

(Default) =

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent]

(Default) =

Other details

Analysis of the file resources indicate the following possible country of origin:

China

The following Host Names were requested from a host database:

192.5.5.241
mxdoo.3322.org

There was registered attempt to establish connection with the remote host. The connection details are:

Remote Host	Port Number
mxdoo.3322.org	3232

Outbound traffic (potentially malicious)

There was an outbound traffic produced on port 3232:

00000000 | 4579 6573 3191 0200 00F4 0300 0078 9C8D | Eyes1........x..
00000010 | 534F 4854 6110 9FE7 B6AD CF95 904A 5010 | SOHTa........JP.
00000020 | DAC0 4422 2A0C C94E B96E 0B1B E4B6 9582 | ..D"*..N.n......
00000030 | E16E 28EE 932D 3749 3335 9ADA B7F4 070F | .n(..-7I35......
00000040 | 05FB 42D0 52C2 0E9E BA04 A106 1508 5E3A | ..B.R.........^:
00000050 | 2C11 64E0 A143 87A5 434A 7FA0 8387 6CFB | ,.d..C..CJ....l.
00000060 | CDFB DEEE 766C 60DE CC7C F3EF F7BD 99AF | ....vl`..|......
00000070 | 3FE6 A159 2272 8335 7063 0551 19E4 3963 | ?..Y"r.5pc.Q..9c
00000080 | 78F4 629F E18B F4F6 0DF8 9A88 7CA4 2852 | x.b.........|.(R
00000090 | 5D41 3E04 7681 3BC0 DB88 A6CD 0B1E FA97 | ]A>.v.;.........
000000A0 | 528E 3D8D DA91 BB3A 4DC6 4AFE 5B65 6BF8 | R.=....:M.J.[ek.
000000B0 | 9697 3576 97CE C61D BFD4 CBE7 D1BF 4A61 | ..5v..........Ja
000000C0 | 204D 0326 172D 7915 B8C3 D90D 282E AA4A |  M.&.-y.....(..J
000000D0 | B828 84FC 4FE0 FBC8 ADF9 96E1 168F C579 | .(..O..........y
000000E0 | 5013 E4B3 ED16 AF83 A975 9126 9C1E CBC0 | P........u.&....
000000F0 | 3D59 E8F9 4EA7 3947 973B EF40 B79F 5A0A | =Y..N.9G.;.@..Z.
00000100 | 465B BDC9 AB7F 0AC8 42E7 3DF4 DE89 7BEB | F[......B.=...{.
00000110 | B6B8 B5A6 8266 A31E 3A03 BD4B D7E9 32E4 | .....f..:..K..2.
00000120 | A97B 3A2D E25C 08B0 29DB 393F 9403 8BFD | .{:-.\..).9?....
00000130 | E289 C922 AF79 D3BC 0419 D42D 0E83 8B17 | ...".y.....-....
00000140 | FFB1 9592 BA6B FD5E 5B77 5765 1C9F 66DB | .....k.^[wWe..f.
00000150 | E382 ED84 C557 90B3 9C9B E234 F4CD E609 | .....W.....4....
00000160 | 7E1A 5035 BADA E787 6416 447A B1A4 FCEF | ~.P5....d.Dz....
00000170 | 3BD1 12E6 10EC 484C 617E 59A9 308B EF77 | ;.....HLa~Y.0..w
00000180 | C0E4 4B38 3FD0 60F2 49D8 9BC8 F930 63D9 | ..K8?.`.I....0c.
00000190 | 670B 2E89 30B9 B1D9 6489 2BFC A73A 6AB1 | g...0...d.+..:j.
000001A0 | E7B2 0A96 293E A82E CD5C B323 545E 8FA6 | ....)>...\.#T^..
000001B0 | 62B2 6E65 4BCD B8C3 A21F 479F B5E5 295E | b.neK.....G...)^
000001C0 | 7F6C 711D 76E5 3558 E64E 9FB7 52AD 476B | .lq.v.5X.N..R.Gk
000001D0 | 692F D49D E028 EA44 60EF B6F7 C9B4 E79B | i/...(.D`.......
000001E0 | 407E C2D9 971B 49CC 754F 2DBD C9A5 6D8C | @~....I.uO-...m.
000001F0 | B217 C151 6370 C44F 9491 830D 4AC9 BE70 | ...Qcp.O....J..p
00000200 | B7DA 439B D0E3 17F2 F7E3 DECF A50E A44C | ..C............L
00000210 | 3E70 BA3D D2D9 113C 1BF6 B707 E93F 292C | >p.=...<.....?),
00000220 | 3B82 F761 5C37 AED2 A3DB 5CDE A030 4ACD | ;..a\7....\..0J.
00000230 | B67D 260B FE87 1F33 FC6A 46E9 23DF 57C6 | .}&....3.jF.#.W.
00000240 | 4CFF A27D 2FB9 7360 D8E8 1D31 1CC4 2E8B | L..}/.s`...1....
00000250 | 078C E141 2379 A4E9 603C 9924 F8CD FA05 | ...A#y..`<.$....
00000260 | 3B8E A22B 6392 1387 5DA0 A2AF F8FF F18E | ;..+c...].......
00000270 | 6E6A 3457 4924 5BCC 87D2 7CEC 4B46 93F3 | nj4WI$[...|.KF..
00000280 | 9EAF 4413 BBE4 4D55 CEC9 5DFF 0270 BBDE | ..D...MU..]..p..
00000290 | ED                                      | .

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.