Submission Summary:

• Submission details:
• Submission received: 27 December 2008, 07:59:15
• Processing time: 10 min 50 sec
• Submitted sample:
• File MD5: 0xAD570E763FB93A3A4232A94FDB4225B5
• File SHA-1: 0xEE1BFF2812467020D8D0E4E05AE441CB4AAFDE5E
• Filesize: 124,416 bytes
• Alias:
• Win32.Sality.X [PCTools]
• Infostealer.Gampass [Symantec]
• Virus.Win32.Sality.q [Kaspersky Lab]
• PWS-Gamania.gen.a [McAfee]
• PE_SALITY.AS [Trend Micro]
• W32/Sality-AA [Sophos]
• Virus:Win32/Sality.R [Microsoft]
• Packed.Win32.PolyCrypt.h [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Trojan-PWS.Onlinegames.BS	Trojan.PWS.Onlinegames.BS is a Trojan that will start itself automatically and steal passwords of onlinegames on the infected machines.
Trojan-PWS.OnlineGames.ARun	Trojan-PWS.OnlineGames.ARun attempts to steal password information associated to popular online games such as MapleStory, Legend of Mir and World of Warcraft. It has the ability to spread itself via removable disk such as USB drives.
Trojan-Proxy.Ranky.GI	Trojan.Proxy.Ranky.GI is a Proxy Trojan which is designed to listen on a specified TCP port for incoming requests. It contacts a remote site to report the infection and then serves as an HTTP proxy, allowing attackers the ability to route HTTP traffic through the infected computer.

• Attention! The following threat categories were identified:

Threat Category	Description
	A network-aware worm that attempts to replicate across the existing network(s)
	A virus capable to modify other files by infecting, prepending, or overwriting them them with its own body
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)
	A hacktool that could be used by attackers to break into a system

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\autorun.inf	323 bytes	MD5: 0x68DD7419072163A54523C5C7C37C2036 SHA-1: 0xA51F2DEF84A55AA7DBF1F3EDC95896F7E878A1A2	Worm.Win32.AutoRun.coi [Kaspersky Lab] VBS/Autorun.worm.k [McAfee] Mal/AutoInf-A [Sophos] Worm:Win32/Taterf!inf [Microsoft] Worm.Win32.AutoRun [Ikarus]
2	c:\d6fagcs8.cmd %System%\amvo.exe [file and pathname of the sample #1]	124,416 bytes	MD5: 0xAD570E763FB93A3A4232A94FDB4225B5 SHA-1: 0xEE1BFF2812467020D8D0E4E05AE441CB4AAFDE5E	Win32.Sality.X [PCTools] Infostealer.Gampass [Symantec] Virus.Win32.Sality.q [Kaspersky Lab] PWS-Gamania.gen.a [McAfee] PE_SALITY.AS [Trend Micro] W32/Sality-AA [Sophos] Virus:Win32/Sality.R [Microsoft] Packed.Win32.PolyCrypt.h [Ikarus]
3	%Temp%\vlmmrcd5.dll	29,827 bytes	MD5: 0x790B046F22031A9DD302CCB6C4B63C2C SHA-1: 0xCB107CA548DD019D00A17744F316F45A4B2492C7	Trojan-PWS.OnlineGames.ARun [PCTools] Hacktool.Rootkit [Symantec] Worm.Win32.AutoRun.coi [Kaspersky Lab] PWS-Gamania.gen.a [McAfee] Mal/EncPk-CE [Sophos] VirTool:Win32/Vanti.gen!D [Microsoft] Rootkit.Win32.Vanti.gv [Ikarus]
4	%System%\amvo1.dll	54,784 bytes	MD5: 0xF5E959EDB7F11DB2D3F75A513CC6F1A4 SHA-1: 0x660331047A75C81C3E6B8FD1205ADC6FBCC65B8F	Trojan.Lineage.Gen!Pac.3 [PCTools] W32.Gammima [Symantec] Worm.Win32.AutoRun.coi [Kaspersky Lab] PWS-Gamania.gen.a [McAfee] Mal_NSAnti-1 [Trend Micro] Mal/EncPk-CE [Sophos] Worm:Win32/Taterf.B.dll [Microsoft] Worm.Win32.AutoRun [Ikarus]
5	%System%\vcmgcd32.dll	36,864 bytes	MD5: 0xAE22CA9F11ADE8E362254B452CC07F78 SHA-1: 0x4B3CB548C547D3BE76E571E0579A609969B05975	Trojan-Proxy.Ranky.GI [PCTools] W32.HLLP.Sality [Symantec] Virus.Win32.Sality.q [Kaspersky Lab] W32/Sality.x.dll [McAfee] PE_SALITY.AS-O [Trend Micro] W32/Sality-AA [Sophos] Virus:Win32/Sality.S [Microsoft] Win32.Worm.Poebot.81408.A [Ikarus]
6	%System%\vcmgcd32.dl_	17,878 bytes	MD5: 0x65EC81C36EFD75F8E4490B0D42AA2CED SHA-1: 0x9BE34710A967A4ECD5A7E6BE0568BF8E2D9BE007	Trojan-Proxy.Ranky.GI [PCTools] W32.HLLP.Sality [Symantec] Virus.Win32.Sality.q [Kaspersky Lab] PE_SALITY.AS-O [Trend Micro] Virus.Win32.Sality [Ikarus]

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	200,704 bytes
amvo.exe	%System%\amvo.exe	200,704 bytes

Registry Modifications

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• amva = "%System%\amvo.exe"

so that amvo.exe runs every time Windows starts

Other details

• To mark the presence in the system, the following Mutex object was created:
• _kuku_joker_v3.09_

• The following Internet download was started (the retrieved bits are saved into the local file):