Submission Summary:

• Submission details:
• Submission received: 24 September 2012, 18:25:27
• Processing time: 8 min 16 sec
• Submitted sample:
• File MD5: 0x4A6D24E907CA0449A638A8AABEFAFE9A
• File SHA-1: 0xD6E320D9AD804C331459C33AB708F8C26275E125
• Filesize: 491,839 bytes
• Alias:
• Suspicious.MH690 [Symantec]
• not-a-virus:Monitor.Win32.Ardamax.vl [Kaspersky Lab]
• Spy-Agent.cv [McAfee]
• TSPY_ARDAMAX.GA [Trend Micro]
• TrojanSpy:Win32/Ardamax.H [Microsoft]
• Trojan-Spy.Win32.Ardamax [Ikarus]
• Win-Trojan/Ardamax.14848.D [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Application.Ardamax_Keylogger	Ardamax Keylogger is a keystroke recorder that captures user's activity and saves it to an encrypted log file. The log file can be viewed with the powerful Log Viewer.
Trojan-Dropper.Agent	Trojan-Dropper.Agent attempts to drop a malicious file and run it on the compromised computer.

• Attention! The following threat category was identified:

Threat Category	Description
	A spyware program that represents security risk for a local system

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\@2.tmp	906,286 bytes	MD5: 0xD189BA536FEBD6F0BAF2E91807D9603D SHA-1: 0x37DC3B274AB7A4259947CCEFBF0295ED7272C959	Virus.Win32.Ardamax [Ikarus]
2	%System%\28463\AKV.exe	404,480 bytes	MD5: 0xB8FA30233794772B8B76B4B1D91C7321 SHA-1: 0x0CF9561BE2528944285E536F41D502BE24C3AA87	Spyware.Ardakey [Symantec] not-a-virus:Monitor.Win32.Ardamax.w [Kaspersky Lab] Keylog-Ardamax [McAfee] Mal/Generic-L [Sophos] MonitoringTool:Win32/Ardamax [Microsoft] not-a-virus:Monitor.Win32.Ardamax.ah [Ikarus] Win-Trojan/Ardamax.404480 [AhnLab]
3	%System%\28463\HRGM.001	474 bytes	MD5: 0xD2AA79049AC53F9766C6F00A171E353D SHA-1: 0x4BB03274C209AE528EFF955C19E26A28AF2E453B	(not available)
4	%System%\28463\HRGM.002	2,536 bytes	MD5: 0xF1C2643D369C513095F478D37E75CF91 SHA-1: 0x66EEB401FC5DB88B1FFAD7DD268CB7C5E1BFE1E6	(not available)
5	%System%\28463\HRGM.006	8,192 bytes	MD5: 0x43F02E9974B1477C1E6388882F233DB0 SHA-1: 0xF3E27B231193F8D5B2E1B09D05AE3A62795CF339	Spyware.Ardakey [Symantec] not-a-virus:Monitor.Win32.Ardamax.mc [Kaspersky Lab] Keylog-Ardamax.dll [McAfee] MonitoringTool:Win32/Ardamax [Microsoft] MonitoringTool [Ikarus] Win-Trojan/Ardamax.7680 [AhnLab]
6	%System%\28463\HRGM.007	5,632 bytes	MD5: 0xB5A87D630436F958C6E1D82D15F98F96 SHA-1: 0xD3FF5E92198D4DF0F98A918071ACA53550BF1CFF	Spyware.Ardakey [Symantec] not-a-virus:Monitor.Win32.Ardamax.o [Kaspersky Lab] Keylog-Ardamax.dll [McAfee] TrojanSpy:WinNT/Ardamax.A!sys [Microsoft] Virus.Win32.Ardamax.GG [Ikarus]
7	%System%\28463\HRGM.exe	484,864 bytes	MD5: 0x17535DDDECF8CB1EFDBA1F1952126547 SHA-1: 0xA862A9A3EB6C201751BE1038537522A5281EA6CB	Spyware.Ardakey [Symantec] not-a-virus:Monitor.Win32.Ardamax.ac [Kaspersky Lab] Keylog-Ardamax [McAfee] MonitoringTool:Win32/Ardamax [Microsoft] Trojan-Spy.Ardamax.J [Ikarus] Win-Trojan/Ardamax.484864 [AhnLab]
8	[file and pathname of the sample #1]	491,839 bytes	MD5: 0x4A6D24E907CA0449A638A8AABEFAFE9A SHA-1: 0xD6E320D9AD804C331459C33AB708F8C26275E125	Suspicious.MH690 [Symantec] not-a-virus:Monitor.Win32.Ardamax.vl [Kaspersky Lab] Spy-Agent.cv [McAfee] TSPY_ARDAMAX.GA [Trend Micro] TrojanSpy:Win32/Ardamax.H [Microsoft] Trojan-Spy.Win32.Ardamax [Ikarus] Win-Trojan/Ardamax.14848.D [AhnLab]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following directory was created:
• %System%\28463

Memory Modifications

• There were new processes created in the system:

• Attention! The following process was intentionally hidden from the user:

Registry Modifications

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• HRGM Agent = "%System%\28463\HRGM.exe"

so that HRGM.exe runs every time Windows starts

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Russian Federation

• To mark the presence in the system, the following Mutex objects were created:
• Local\{E3893ABF-53E0-4228-9A27-1C69FB1D67C2}
• oleacc-msaa-loaded

• There were application-defined hook procedures installed into the hook chain (e.g. to monitor keystrokes). The installed hooks are handled by the following modules:
• %System%\28463\akv.exe
• %System%\28463\HRGM.exe
• %System%\28463\HRGM.006
• %System%\28463\HRGM.007