Submission Summary:

• Submission details:
• Submission received: 9 July 2009, 02:26:05
• Processing time: 7 min 18 sec
• Submitted sample:
• File MD5: 0x11C34DFAAB5358DB16230F210B734748
• File SHA-1: 0x01AA3D51E3636A2E6F8C7FFD9E98D54598AED09A
• Filesize: 106,626 bytes
• Alias:
• W32.Gammima.AG [Symantec]
• Trojan.Win32.Agent.aosw [Kaspersky Lab]
• Generic Downloader.ab [McAfee]
• Mal/EncPk-IG, Mal/Frethog-B [Sophos]
• Worm:Win32/Taterf.B [Microsoft]
• Packed.Win32.Krap [Ikarus]
• Win-Trojan/Agent.106626 [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Sets the drive to autoplay by creating autorun.inf file in its root directory. If the drive is shared across the network then other remote computers can be infected any time they try to access this share.
Downloads/requests other files from Internet.
Modifies some system settings that may have negative impact on overall system security state.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Trojan-PWS.Magania.AHIW	Trojan-PWS.Magania.AHIW is threat that tries to monitors user activities in hopes to obtain valuable information from the affected user, specifically gaming login informations.

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A network-aware worm that attempts to replicate across the existing network(s)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\abk.bat %System%\kamsoft.exe [file and pathname of the sample #1]	106,626 bytes	MD5: 0x11C34DFAAB5358DB16230F210B734748 SHA-1: 0x01AA3D51E3636A2E6F8C7FFD9E98D54598AED09A	W32.Gammima.AG [Symantec] Trojan.Win32.Agent.aosw [Kaspersky Lab] Generic Downloader.ab [McAfee] Mal/EncPk-IG, Mal/Frethog-B [Sophos] Worm:Win32/Taterf.B [Microsoft] Packed.Win32.Krap [Ikarus] Win-Trojan/Agent.106626 [AhnLab]
2	c:\autorun.inf	563 bytes	MD5: 0xBA3DC3689D5BE114D148658FA3A1B416 SHA-1: 0xC0B16613A859246F7D2ABEF87A5B5E8D45269258	Worm.Win32.AutoRun.wun [Kaspersky Lab] Mal/AutoInf-A, Mal/AutoInf-B [Sophos] Worm.Win32.AutoRun [Ikarus] TextImage/Autorun [AhnLab]
3	%System%\gasretyw0.dll %System%\gasretyw1.dll %System%\gasretyw2.dll	85,504 bytes	MD5: 0x22AEF557511BCA053936FD3E74653A64 SHA-1: 0xCB96E327EFB0CC7EC6EB7CF5ABBF5A547A85B3CF	W32.Gammima.AG [Symantec] Packed.Win32.Krap.b [Kaspersky Lab] Generic PWS.ak [McAfee] Mal/EncPk-IG, Troj/Virtum-Gen [Sophos] PWS:Win32/Frethog.gen!B [Microsoft] Win-Trojan/Krap.85504.O [AhnLab]

• Note:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
iexplore.exe	%ProgramFiles%\Internet Explorer\iexplore.exe	102,400 bytes
kamsoft.exe	%System%\kamsoft.exe	225,280 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	225,280 bytes

• Notes:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

• The following modules were loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
gasretyw2.dll	%System%\gasretyw2.dll	Process name: explorer.exe Process filename: %Windir%\explorer.exe Address space: 0x1C50000 - 0x1C7D000
gasretyw0.dll	%System%\gasretyw0.dll	Process name: IEXPLORE.EXE Process filename: %ProgramFiles%\internet explorer\iexplore.exe Address space: 0x1B00000 - 0x1B2D000

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Registry Modifications

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• kamsoft = "%System%\kamsoft.exe"

so that kamsoft.exe runs every time Windows starts

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
• CheckedValue = 0x00000000

so that hidden files and folders are not displayed in explorer when browsing the file system

Other details

• The following Internet download was started (the retrieved bits are saved into the local file):

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).