ThreatExpert Report: Spyware.Ardakey, Trojan-Spy.Win32.Ardamax.cko, Spy-Agent.cv, TSPY

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 22 September 2012, 22:42:56
Processing time: 10 min 2 sec
Submitted sample:

File MD5: 0x58488C76E6D0FD22564E21404013B5A5
File SHA-1: 0x99490D02A265FCA0B0BC9E872AD97692B0D15180
Filesize: 1,636,761 bytes
Alias:

Spyware.Ardakey [Symantec]
Trojan-Spy.Win32.Ardamax.cko [Kaspersky Lab]
Spy-Agent.cv [McAfee]
TSPY_ARDAMAX.HR [Trend Micro]
Mal/Behav-043 [Sophos]
TrojanSpy:Win32/Ardamax.BI [Microsoft]
Trojan-Spy.Win32.Ardamax [Ikarus]
Dropper/Downloader.817294 [AhnLab]

Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! The following threat categories were identified:

Threat Category	Description
	A spyware program that represents security risk for a local system
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\@2.tmp	1,913,588 bytes	MD5: 0xAAC9F0D6F6BCA573F12E75FE5E33FEA7 SHA-1: 0xEE204A0C06D53CEB79BADC65D06ED81723886CF2	Trojan-Spy.Ardamax.J [Ikarus]
2	%Temp%\Smu_Panas_Beredar (1).3gp	764,027 bytes	MD5: 0xAD31960A1842BB649B7734CB576DBBB9 SHA-1: 0x385A4A78106FEC539459EDF87939F1E59709AB61	(not available)
3	%System%\28463\AKV.exe	468,480 bytes	MD5: 0x42E2202AC32EDB39CCF9979515018D85 SHA-1: 0xC1E07FBE2FA759E2775D4DCF7DE23A66D2422A1A	Spyware.Ardakey [Symantec] Keylog-Ardamax [McAfee] MonitoringTool:Win32/Ardamax [Microsoft] Trojan.Generic [Ikarus] Win-Trojan/Xema.variant [AhnLab]
4	%System%\28463\key.bin	105 bytes	MD5: 0x27C90D4D9B049F4CD00F32ED1D2E5BAF SHA-1: 0x338A3EA8F1E929D8916ECE9B6E91E697EB562550	(not available)
5	%System%\28463\VLXX.001	412 bytes	MD5: 0x30480670DBEDE82C3E9FA67F4E642FEC SHA-1: 0x5D46C5EB221C7DBCD14A650F77A5107E39534EE8	(not available)
6	%System%\28463\VLXX.002	1,504 bytes	MD5: 0xFCA5F136A530B3E39855D2BDEDF6A999 SHA-1: 0xE45B04DB41A57A5D450FE597FFE44D6BBF436EA8	(not available)
7	%System%\28463\VLXX.006	8,192 bytes	MD5: 0x3DA3041787B72A7909D9F6184CE6BC5E SHA-1: 0xFC7F00B8A1341B5341E2BA6F94BA85364BC90843	Spyware.Ardakey [Symantec] not-a-virus:Monitor.Win32.Ardamax.mh [Kaspersky Lab] Keylog-Ardamax.dll [McAfee] MonitoringTool:Win32/Ardamax [Microsoft] MonitoringTool [Ikarus]
8	%System%\28463\VLXX.007	5,632 bytes	MD5: 0x50D0BCF6B5A6B11D9E274CCEFBA3F02E SHA-1: 0x57ACF2A1236B7534F2DB661A9D95AEADCD41AA2A	Spyware.Ardakey [Symantec] not-a-virus:Monitor.Win32.Ardamax.o [Kaspersky Lab] Keylog-Ardamax.dll [McAfee] MonitoringTool:Win32/Ardamax [Microsoft] Virus.Win32.Ardamax.GG [Ikarus]
9	%System%\28463\VLXX.exe	663,040 bytes	MD5: 0xA7B322839CEDF8D56CB0A7DCDB50AB59 SHA-1: 0xD27855E65F5D9E87666F39D2AF694A0D75330A75	Spyware.Ardakey [Symantec] Trojan-Spy.Win32.Ardamax.amt [Kaspersky Lab] Keylog-Ardamax [McAfee] Mal/Generic-L [Sophos] MonitoringTool:Win32/Ardamax [Microsoft] Virus.Win32.Ardamax.CI [Ikarus] Win-Trojan/Ardamax.663040.B [AhnLab]
10	[file and pathname of the sample #1]	1,636,761 bytes	MD5: 0x58488C76E6D0FD22564E21404013B5A5 SHA-1: 0x99490D02A265FCA0B0BC9E872AD97692B0D15180	Spyware.Ardakey [Symantec] Trojan-Spy.Win32.Ardamax.cko [Kaspersky Lab] Spy-Agent.cv [McAfee] TSPY_ARDAMAX.HR [Trend Micro] Mal/Behav-043 [Sophos] TrojanSpy:Win32/Ardamax.BI [Microsoft] Trojan-Spy.Win32.Ardamax [Ikarus] Dropper/Downloader.817294 [AhnLab]

Notes:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following directory was created:

%System%\28463

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	110,592 bytes
VLXX.exe	%System%\28463\VLXX.exe	913,408 bytes

Attention! The following process was intentionally hidden from the user:

Process Name	Main Module Size
VLXX.exe	913,408 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9A166EFD-8010-467F-AE8D-F2FA4D41C87B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9A166EFD-8010-467F-AE8D-F2FA4D41C87B}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9A166EFD-8010-467F-AE8D-F2FA4D41C87B}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9A166EFD-8010-467F-AE8D-F2FA4D41C87B}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9A166EFD-8010-467F-AE8D-F2FA4D41C87B}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{058221A7-5FA9-64FB-43F2-6D5BFFFE8FA4}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{058221A7-5FA9-64FB-43F2-6D5BFFFE8FA4}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{058221A7-5FA9-64FB-43F2-6D5BFFFE8FA4}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{058221A7-5FA9-64FB-43F2-6D5BFFFE8FA4}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{058221A7-5FA9-64FB-43F2-6D5BFFFE8FA4}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{058221A7-5FA9-64FB-43F2-6D5BFFFE8FA4}\1.0\HELPDIR
HKEY_CURRENT_USER\Software\ASProtect
HKEY_CURRENT_USER\Software\ASProtect\SpecData

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9A166EFD-8010-467F-AE8D-F2FA4D41C87B}\VersionIndependentProgID]

(Default) = "IMAPI.MSDiscRecorderObj"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9A166EFD-8010-467F-AE8D-F2FA4D41C87B}\TypeLib]

(Default) = "{058221A7-5FA9-64FB-43F2-6D5BFFFE8FA4}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9A166EFD-8010-467F-AE8D-F2FA4D41C87B}\ProgID]

(Default) = "IMAPI.MSDiscRecorderObj.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9A166EFD-8010-467F-AE8D-F2FA4D41C87B}\LocalServer32]

(Default) = "%System%\imapi.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9A166EFD-8010-467F-AE8D-F2FA4D41C87B}]

(Default) = "Exodom Amidolde class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{058221A7-5FA9-64FB-43F2-6D5BFFFE8FA4}\1.0\0\win32]

(Default) = "%System%\tapi3.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{058221A7-5FA9-64FB-43F2-6D5BFFFE8FA4}\1.0\HELPDIR]

(Default) = "%System%\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{058221A7-5FA9-64FB-43F2-6D5BFFFE8FA4}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{058221A7-5FA9-64FB-43F2-6D5BFFFE8FA4}\1.0\0]

(Default) = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{058221A7-5FA9-64FB-43F2-6D5BFFFE8FA4}\1.0]

(Default) = "Microsoft TAPI 3.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{058221A7-5FA9-64FB-43F2-6D5BFFFE8FA4}]

(Default) = ""

[HKEY_CURRENT_USER\Software\ASProtect\SpecData]

(Default) = "F74DB923F74DB923"
F74DB923F74DB923 = 15 9B FB F3 2B 8C BC AE 2D E1 77 72 2C 2C 79 2E C8 1C F1 6B 0F 0A 89 D6 A2 59 68 7E 65 73 EA 0A C9 05 74 73 B4 10 D8 B0 EF 93 AC A3 FA C6 74 EF 57 67 68 6F 89 EA 07 FC 60 E7 2D B9 90 20 D4 EA 90 35 65 45 BE 43 05 3D F2 C5 13 DF BD CD B0 11 4A 3B E9 B

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

VLXX Agent = "%System%\28463\VLXX.exe"

so that VLXX.exe runs every time Windows starts

Other details

To mark the presence in the system, the following Mutex objects were created:

Local\{8761A525-8891-4f1b-85AF-2BC5EB12238A}
oleacc-msaa-loaded

There were application-defined hook procedures installed into the hook chain (e.g. to monitor keystrokes). The installed hooks are handled by the following modules:

%System%\28463\akv.exe
%System%\28463\VLXX.exe
%System%\28463\VLXX.006
%System%\28463\VLXX.007

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.