Submission Summary:

• Submission details:
• Submission received: 1 September 2010, 03:14:51
• Processing time: 6 min 48 sec
• Submitted sample:
• File MD5: 0x209B681F2E1607395F512C12300D4B21
• File SHA-1: 0xD48ACADC39DE6A8B185EFB3E142BC0D135135474
• Filesize: 94,208 bytes
• Alias & packer info:
• Malware.Gammima [PCTools]
• W32.Gammima.AG!gen4 [Symantec]
• Trojan-GameThief.Win32.Magania.cxku [Kaspersky Lab]
• PWS-Gamania.gen [McAfee]
• Mal/Generic-L [Sophos]
• Trojan-GameThief.Win32.Magania [Ikarus]
• Win-Trojan/Magania.94208.BH [AhnLab]
• packed with: ASPack [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Sets the drive to autoplay by creating autorun.inf file in its root directory. If the drive is shared across the network then other remote computers can be infected any time they try to access this share.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\autorun.inf	51 bytes	MD5: 0x7B6977993E6C4A3649FAD44113BEF635 SHA-1: 0x498F939757DD5C8D079BAEE4C04202ED98BF0DD2	Generic!atr [McAfee] Troj/Taterf-D [Sophos] Win32.Worm.Taterf [Ikarus]
2	%Temp%\4tddfwq0.dll %Temp%\4tddfwq1.dll	85,504 bytes	MD5: 0x11760C19EE2E0DC1208D6054DC59441A SHA-1: 0xDDF832CAB605F1B2BFCF2FA2BCB94D8BE9933D84	Trojan-PSW.Gampass [PCTools] Infostealer.Gampass [Symantec] PWS-OnlineGames.hh [McAfee] Trojan-GameThief.Win32.Magania [Ikarus] Win-Trojan/Onlinegamehack.85504.AQ [AhnLab] packed with ASPack [Kaspersky Lab]
3	%Temp%\xvassdf.exe c:\q1.exe [file and pathname of the sample #1]	94,208 bytes	MD5: 0x209B681F2E1607395F512C12300D4B21 SHA-1: 0xD48ACADC39DE6A8B185EFB3E142BC0D135135474	Malware.Gammima [PCTools] W32.Gammima.AG!gen4 [Symantec] Trojan-GameThief.Win32.Magania.cxku [Kaspersky Lab] PWS-Gamania.gen [McAfee] Mal/Generic-L [Sophos] Trojan-GameThief.Win32.Magania [Ikarus] Win-Trojan/Magania.94208.BH [AhnLab] packed with ASPack [Kaspersky Lab]

• Note:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Registry Modifications

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• 54dfsger = "%Temp%\xvassdf.exe"

so that xvassdf.exe runs every time Windows starts

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
• CheckedValue =