ThreatExpert Report: Win32.Sality.AM.Gen, W32.Imaut, Worm.Win32.AutoRun.erd, W32/Sality.gen..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 6 April 2009, 02:03:11
Processing time: 6 min 9 sec
Submitted sample:

File MD5: 0x9F1E4B4ABA41FEE772EDD32948158F98
File SHA-1: 0x906040CE3AD21C59BA9B6732B0BC8C177180031B
Filesize: 1,137,042 bytes
Alias:

Win32.Sality.AM.Gen [PCTools]
W32.Imaut [Symantec]
Worm.Win32.AutoRun.erd [Kaspersky Lab]
W32/Sality.gen [McAfee]
PE_DELZIUM.A [Trend Micro]
W32/Sality-AM [Sophos]
Virus:Win32/Sality.AM [Microsoft]
Trojan.Autoit [Ikarus]
Win-Trojan/Agent.1075602 [AhnLab]

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Modifies some system settings that may have negative impact on overall system security state.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Trojan-PWS.Sagi	Trojan.PWS.Sagi is a Trojan which on execution installs itself as a legitimate program, runs in the background and monitors Yahoo! Messenger. It captures passwords entered in the Yahoo! Messenger windows and sends those passwords to the author of this Trojan.
Application.WinSession_Keylogger	WinSession Keylogger is a Monitoring software from Cromosoft Technologies. It can run in stealth mode and capture all keystrokes, applications used, emails, text and images from clipboard, chat sessions, instant messages, websites visited and can take screenshots of the system at regular intervals or mouse clicks. It has content filters which can be configured to block websites and applications. All the information captured is stored by this software in log files and it has the ability to send these log files to a specified email address. Removal of this software is advisable if it is not installed for a purpose.

Attention! The following threat categories were identified:

Threat Category	Description
	A network-aware worm that attempts to replicate across the existing network(s)
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Windir%\regsvr.exe %System%\regsvr.exe [file and pathname of the sample #1] %System%\svchost .exe	1,137,042 bytes	MD5: 0x9F1E4B4ABA41FEE772EDD32948158F98 SHA-1: 0x906040CE3AD21C59BA9B6732B0BC8C177180031B	Win32.Sality.AM.Gen [PCTools] W32.Imaut [Symantec] Worm.Win32.AutoRun.erd [Kaspersky Lab] W32/Sality.gen [McAfee] PE_DELZIUM.A [Trend Micro] W32/Sality-AM [Sophos] Virus:Win32/Sality.AM [Microsoft] Trojan.Autoit [Ikarus] Win-Trojan/Agent.1075602 [AhnLab]
2	%System%\dotnetfx.dll	16,384 bytes	MD5: 0x241B0DC14DB6AD8ABCAB86E963765C30 SHA-1: 0x256BB8175BFCC525DCA15AB88008B1F0AA071FE7	Trojan Horse [Symantec] Backdoor.Win32.Agent.tig [Kaspersky Lab] Generic BackDoor [McAfee] W32/Impair-A [Sophos] Trojan-Dropper.Agent [Ikarus] packed with PE_Patch.UPX [Kaspersky Lab]
3	%System%\setup.ini	96 bytes	MD5: 0x9ECE103C47335F0CC777F1132B8D522F SHA-1: 0x63AFA171C64F86D99DB81723E1335E960E85FA43	Generic!atr [McAfee] W32/AutoIt-O [Sophos] Trojan.Autorun.QO [Ikarus] TextImage/Autorun [AhnLab]
4	%Windir%\Tasks\At1.job	350 bytes	MD5: 0x30BDAC2832E5F513E6A5439DAB3CC1A1 SHA-1: 0x55DA815289B97493D84852FDDD8A3A48486D14EF	(not available)
5	%Windir%\Tasks\At2.job	350 bytes	MD5: 0x46B8973A037BBAF1C9759F328489C8F3 SHA-1: 0xAF31E3F3707132906240A698631503F1566C1035	(not available)

Notes:

%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following directory was created:

%System%\28463

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	1,216,512 bytes
regsvr.exe	%System%\regsvr.exe	1,216,512 bytes
regsvr.exe	%Windir%\regsvr.exe	1,216,512 bytes

The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
dotnetfx.dll	%System%\dotnetfx.dll	Process name: [generic host process] Process filename: [generic host process filename] Address space: 0x390000 - 0x39E000

Notes:

[generic host process filename] is a full path filename of [generic host process].

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DotNetRecovery
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

.Net Recovery = "rundll32.exe dotnetfx.dll,repair"

so that dotnetfx.dll runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DotNetRecovery]

(Default) = "A"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

NofolderOptions = 0x00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]

DisableTaskMgr = 0x00000000
DisableRegistryTools = 0x00000001

to disable the Windows registry editors (Regedt32.exe and Regedit.exe)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

Msn Messsenger = "%System%\regsvr.exe"

so that regsvr.exe runs every time Windows starts

The following Registry Value was modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

Shell = "Explorer.exe regsvr.exe"

so that regsvr.exe runs every time Windows starts

Other details

Analysis of the file resources indicate the following possible country of origin:

United Kingdom

To mark the presence in the system, the following Mutex object was created:

Op1mutx9

The data identified by the following URLs was then requested from the remote web server:

http://yahoo.com/setting.doc
localhost
http://yahoo.com/setting.xls
http://www.yahoo.com/setting.doc
http://www.yahoo.com/setting.xls

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.