ThreatExpert Report: Trojan-GameThief.Win32.OnLineGames.vrbp, Trojan-PWS.Win32.Lmir..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 8 October 2009, 22:32:19
Processing time: 7 min 47 sec
Submitted sample:

File MD5: 0x4B986C7E95E673BEA996C6613A245030
File SHA-1: 0xD08552D2BCF1ED478861675044CC54A2FABF5D81
Filesize: 243,253 bytes
Alias:

Trojan-GameThief.Win32.OnLineGames.vrbp [Kaspersky Lab]
Trojan-PWS.Win32.Lmir [Ikarus]
Dropper/Xema.243253 [AhnLab]

Summary of the findings:

What's been found	Severity Level
Registers a 32-bit in-process server DLL.
Contains characteristics of an identified security risk.

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

Possible Security Risk

Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Trojan-Downloader.Banload.HNC	Trojan-Downloader.Banload.HNC attempts to download malicious files to the local computer and execute them
Trojan-PWS.Magania	Trojan.PSW.Magania steals online gaming login information.

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Windir%\2.bat	64 bytes	MD5: 0x543D76AD65E18CF9B370723AFB27FC68 SHA-1: 0xEF75730E4CCBF1C1D3A6088740BCD953BD4D6BA4	(not available)
2	%Windir%\Help\F3C74E3FA248.dll	80,896 bytes	MD5: 0x497509746BEE355DF93B5F3EF02EB917 SHA-1: 0xFB69343E0309275BBE75579239F1200CC30D2CB8	W32.Gammima [Symantec] Trojan-GameThief.Win32.OnLineGames.vrdp [Kaspersky Lab] Mal/LineDLL-B, Mal/Packer [Sophos] Trojan.Crypt [Ikarus]
3	%Windir%\Help\F3C74E3FA248.exe	125,952 bytes	MD5: 0xB3C93A2183ECD3E3D86D2E3142A4CA6A SHA-1: 0x6A98706DF74FAF6506B6A481C4428F8754AC3CD8	W32.Gammima [Symantec] Trojan-GameThief.Win32.OnLineGames.vrbp [Kaspersky Lab] Mal/Packer [Sophos] Trojan-PWS.Win32.Lmir.AGP [Ikarus]
4	%Windir%\o1.jpg	16,122 bytes	MD5: 0x6197A40343D8FAA8777B6C66698320F6 SHA-1: 0xBE8F6813D062FEFDE6F55F1507FB2E40664F7708	(not available)
5	%Windir%\o1.vbs	131 bytes	MD5: 0xB3AC709E270FC8B1F6778B32A0E0E331 SHA-1: 0x6E5848AA8B9EC546D0137B892178EDC8A03F9858	(not available)
6	[file and pathname of the sample #1]	243,253 bytes	MD5: 0x4B986C7E95E673BEA996C6613A245030 SHA-1: 0xD08552D2BCF1ED478861675044CC54A2FABF5D81	Trojan-GameThief.Win32.OnLineGames.vrbp [Kaspersky Lab] Trojan-PWS.Win32.Lmir [Ikarus] Dropper/Xema.243253 [AhnLab]

Note:

%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	143,360 bytes
ttc.exe	%Windir%\ttc.exe	913,408 bytes
f3c74e3fa248.exe	%Windir%\help\f3c74e3fa248.exe	913,408 bytes

The following modules were loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
F3C74E3FA248.dll	%Windir%\HELP\F3C74E3FA248.dll	Process name: explorer.exe Process filename: %Windir%\explorer.exe Address space: 0x1E60000 - 0x1F04000
F3C74E3FA248.dll	%Windir%\HELP\F3C74E3FA248.dll	Process name: msmsgs.exe Process filename: %ProgramFiles%\messenger\msmsgs.exe Address space: 0xD60000 - 0xE04000
F3C74E3FA248.dll	%Windir%\HELP\F3C74E3FA248.dll	Process name: dllhost.exe Process filename: %System%\dllhost.exe Address space: 0x2890000 - 0x2934000
F3C74E3FA248.dll	%Windir%\HELP\F3C74E3FA248.dll	Process name: sdnsmain.exe Process filename: %Windir%\dns\sdnsmain.exe Address space: 0x1620000 - 0x16C4000
F3C74E3FA248.dll	%Windir%\HELP\F3C74E3FA248.dll	Process name: [generic host process] Process filename: [generic host process filename] Address space: 0x1010000 - 0x10B4000

Notes:

%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
[generic host process filename] is a full path filename of [generic host process].

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32
HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host
HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings
HKEY_CURRENT_USER\Software\WinRAR SFX

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32]

(Default) = "%Windir%\HELP\F3C74E3FA248.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}]

(Default) = "SSUUDL"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

{1DBD6574-D6D0-4782-94C3-69619E719765} = ""

[HKEY_CURRENT_USER\Software\WinRAR SFX]

C%%WINDOWS = "C:\WINDOWS"

Other details

Analysis of the file resources indicate the following possible country of origin:

China

To mark the presence in the system, the following Mutex objects were created:

_SHuassist.mtx
eXPressor_InstanceChecker_53
WSXIHUDS

There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:

%Windir%\HELP\F3C74E3FA248.dll

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.