ThreatExpert Report: Malware.Zimuse, W32.Zimuse, Worm.Win32.Mseus.a, W32/Zimuse, W32/Mseus-A..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 2 February 2010, 18:48:06
Processing time: 6 min 12 sec
Submitted sample:

File MD5: 0x63A6A43F94C06334E3B9249D374B8114
File SHA-1: 0x2D04B5B5300325AA7005D8CFEA0A64BBEE54F905
Filesize: 228,352 bytes
Alias & packer info:

Malware.Zimuse [PCTools]
W32.Zimuse [Symantec]
Worm.Win32.Mseus.a [Kaspersky Lab]
W32/Zimuse [McAfee]
W32/Mseus-A [Sophos]
Trojan.Win32.SuspectCRC [Ikarus]
Win32/Zimuse.worm.228352 [AhnLab]
packed with: PE_Patch.PECompact [Kaspersky Lab]

Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! The following threat categories were identified:

Threat Category	Description
	A virus capable to modify other files by infecting, prepending, or overwriting them them with its own body
	A network-aware worm that attempts to replicate across the existing network(s)

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\IQTEST\Iqtest.exe	97,424 bytes	MD5: 0x0291B82814B955C40B5BE8228F8D62F6 SHA-1: 0x52E2BB7C1ADD6C6AB37AE787D8940739D1BF255F	(not available)
2	c:\IQTEST\Readme.txt	73 bytes	MD5: 0xEBE86F14A160CA1EA60618A41FC23077 SHA-1: 0x4836090DB325E89A0895CC6C8D6E0A7D9BE486F2	(not available)
3	%ProgramFiles%\Dump\Dump.exe	28,672 bytes	MD5: 0xAF093A8D9600578A2943CAD3F4BDBFE4 SHA-1: 0x0833FE86705C242D3CF673C4069ACA7EC9C8D9BB	Worm.Zimuse [Ikarus] Win32/Zimuse.worm.28672 [AhnLab]
4	%System%\ainf.inf	41 bytes	MD5: 0x3DA5BB2C16D1A81FCE4003FA753E5C7C SHA-1: 0x2203227E27A3797331DF4E12CBDD213419678214	W32/Zimuse!inf [McAfee] Worm.Win32.Zumes [Ikarus]
5	%System%\drivers\Mseu.sys	18,188 bytes	MD5: 0xCA5D3AB3129C458327806E8A03DB9C64 SHA-1: 0x6A0E14114C64284413A9E42B5FB223B41325F427	Malware.Zimuse [PCTools] W32.Zimuse.B [Symantec] Virus.Win32.Mseus.a [Kaspersky Lab] W32/Zimuse!sys [McAfee] W32/Mseus-C [Sophos] Worm:Win32/Zumes.A!sys [Microsoft] Win32/Zimuse.worm.18188 [AhnLab]
6	%System%\drivers\Mstart.sys	13,100 bytes	MD5: 0x12344570FD79F4762361D6AA62295BD8 SHA-1: 0xCCC079E4EC55E8D2202A778524F7731C36CC3887	Malware.Zimuse [PCTools] W32.Zimuse.B [Symantec] Virus.Win32.Mseus.a [Kaspersky Lab] W32/Zimuse!sys [McAfee] W32/Mseus-G [Sophos] Worm:Win32/Zumes.A!sys [Microsoft] Win32/Zimuse.worm.13100 [AhnLab]
7	%System%\mseus.exe	69,632 bytes	MD5: 0x4E3A9B006CA416FA698AF8AF81800698 SHA-1: 0x32F150E272C717C24E2F47D18CD4C4D7B159CCEA	Malware.Zimuse [PCTools] W32.Zimuse.B [Symantec] Virus.Win32.Mseus.a [Kaspersky Lab] W32/Zimuse [McAfee] WORM_ZIMUS.SM [Trend Micro] W32/Mseus-E [Sophos] Worm:Win32/Zumes.A [Microsoft] Virus.Win32.Mseus [Ikarus] Win32/Zimuse.worm.69632 [AhnLab]
8	[file and pathname of the sample #1] %System%\tokset.dll	228,352 bytes	MD5: 0x63A6A43F94C06334E3B9249D374B8114 SHA-1: 0x2D04B5B5300325AA7005D8CFEA0A64BBEE54F905	Malware.Zimuse [PCTools] W32.Zimuse [Symantec] Worm.Win32.Mseus.a [Kaspersky Lab] W32/Zimuse [McAfee] W32/Mseus-A [Sophos] Trojan.Win32.SuspectCRC [Ikarus] Win32/Zimuse.worm.228352 [AhnLab] packed with PE_Patch.PECompact [Kaspersky Lab]

Notes:

%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following directories were created:

c:\IQTEST
%ProgramFiles%\Dump

Memory Modifications

There was a new kernel-mode driver installed in the system:

Driver Name	Driver Filename
MSTART.SYS	%System%\drivers\mstart.sys

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MSTART
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MSTART\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MSTART\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Mseu
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSTART
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSTART\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSTART\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UnzipService
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSTART
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSTART\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSTART\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mseu
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSTART
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSTART\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSTART\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UnzipService

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

Dump = "%ProgramFiles%\Dump\Dump.exe"

so that Dump.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MSTART\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "MSTART"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MSTART\0000]

Service = "MSTART"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "MSTART"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MSTART]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Mseu]

Type = 0x00000001
Start = 0x00000002
ErrorControl = 0x00000001
Tag = 0x00000001
Group = "Extended base"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSTART\Enum]

0 = "Root\LEGACY_MSTART\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSTART\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSTART]

Type = 0x00000001
Start = 0x00000003
ErrorControl = 0x00000001
ImagePath = "%System%\Drivers\MSTART.SYS"
DisplayName = "MSTART"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UnzipService]

Type = 0x00000110
Start = 0x00000002
ImagePath = "System32\Mseus.exe"
ErrorControl = 0x00000000
DisplayName = "Self extract service"
ObjectName = "LocalSystem"
Description = "Self extract archive decrypt"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSTART\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "MSTART"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSTART\0000]

Service = "MSTART"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "MSTART"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSTART]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mseu]

Type = 0x00000001
Start = 0x00000002
ErrorControl = 0x00000001
Tag = 0x00000001
Group = "Extended base"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSTART\Enum]

0 = "Root\LEGACY_MSTART\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSTART\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSTART]

Type = 0x00000001
Start = 0x00000003
ErrorControl = 0x00000001
ImagePath = "%System%\Drivers\MSTART.SYS"
DisplayName = "MSTART"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UnzipService]

Type = 0x00000110
Start = 0x00000002
ImagePath = "System32\Mseus.exe"
ErrorControl = 0x00000000
DisplayName = "Self extract service"
ObjectName = "LocalSystem"
Description = "Self extract archive decrypt"

Other details

Analysis of the file resources indicate the following possible country of origin:

Slovakia

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.