Submission Summary:

What's been foundSeverity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

 

Technical Details:

 

Possible Security Risk

Security RiskDescription
Trojan-PWS.Onlinegames.BS Trojan.PWS.Onlinegames.BS is a Trojan that will start itself automatically and steal passwords of onlinegames on the infected machines.
Trojan-PWS.OnlineGames.ARun Trojan-PWS.OnlineGames.ARun attempts to steal password information associated to popular online games such as MapleStory, Legend of Mir and World of Warcraft. It has the ability to spread itself via removable disk such as USB drives.
Trojan-Proxy.Ranky.GI Trojan.Proxy.Ranky.GI is a Proxy Trojan which is designed to listen on a specified TCP port for incoming requests. It contacts a remote site to report the infection and then serves as an HTTP proxy, allowing attackers the ability to route HTTP traffic through the infected computer.

Threat CategoryDescription
A network-aware worm that attempts to replicate across the existing network(s)
A virus capable to modify other files by infecting, prepending, or overwriting them them with its own body
A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)
A hacktool that could be used by attackers to break into a system

 

File System Modifications

#Filename(s)File SizeFile HashAlias
1 c:\autorun.inf 323 bytes MD5: 0x68DD7419072163A54523C5C7C37C2036
SHA-1: 0xA51F2DEF84A55AA7DBF1F3EDC95896F7E878A1A2
Worm.Win32.AutoRun.coi [Kaspersky Lab]
VBS/Autorun.worm.k [McAfee]
Mal/AutoInf-A [Sophos]
Worm:Win32/Taterf!inf [Microsoft]
Worm.Win32.AutoRun [Ikarus]
2 c:\d6fagcs8.cmd
%System%\amvo.exe
[file and pathname of the sample #1]
124,416 bytes MD5: 0xAD570E763FB93A3A4232A94FDB4225B5
SHA-1: 0xEE1BFF2812467020D8D0E4E05AE441CB4AAFDE5E
Win32.Sality.X [PCTools]
Infostealer.Gampass [Symantec]
Virus.Win32.Sality.q [Kaspersky Lab]
PWS-Gamania.gen.a [McAfee]
PE_SALITY.AS [Trend Micro]
W32/Sality-AA [Sophos]
Virus:Win32/Sality.R [Microsoft]
Packed.Win32.PolyCrypt.h [Ikarus]
3 %Temp%\vlmmrcd5.dll 29,827 bytes MD5: 0x790B046F22031A9DD302CCB6C4B63C2C
SHA-1: 0xCB107CA548DD019D00A17744F316F45A4B2492C7
Trojan-PWS.OnlineGames.ARun [PCTools]
Hacktool.Rootkit [Symantec]
Worm.Win32.AutoRun.coi [Kaspersky Lab]
PWS-Gamania.gen.a [McAfee]
Mal/EncPk-CE [Sophos]
VirTool:Win32/Vanti.gen!D [Microsoft]
Rootkit.Win32.Vanti.gv [Ikarus]
4 %System%\amvo1.dll 54,784 bytes MD5: 0xF5E959EDB7F11DB2D3F75A513CC6F1A4
SHA-1: 0x660331047A75C81C3E6B8FD1205ADC6FBCC65B8F
Trojan.Lineage.Gen!Pac.3 [PCTools]
W32.Gammima [Symantec]
Worm.Win32.AutoRun.coi [Kaspersky Lab]
PWS-Gamania.gen.a [McAfee]
Mal_NSAnti-1 [Trend Micro]
Mal/EncPk-CE [Sophos]
Worm:Win32/Taterf.B.dll [Microsoft]
Worm.Win32.AutoRun [Ikarus]
5 %System%\vcmgcd32.dll 36,864 bytes MD5: 0xAE22CA9F11ADE8E362254B452CC07F78
SHA-1: 0x4B3CB548C547D3BE76E571E0579A609969B05975
Trojan-Proxy.Ranky.GI [PCTools]
W32.HLLP.Sality [Symantec]
Virus.Win32.Sality.q [Kaspersky Lab]
W32/Sality.x.dll [McAfee]
PE_SALITY.AS-O [Trend Micro]
W32/Sality-AA [Sophos]
Virus:Win32/Sality.S [Microsoft]
Win32.Worm.Poebot.81408.A [Ikarus]
6 %System%\vcmgcd32.dl_ 17,878 bytes MD5: 0x65EC81C36EFD75F8E4490B0D42AA2CED
SHA-1: 0x9BE34710A967A4ECD5A7E6BE0568BF8E2D9BE007
Trojan-Proxy.Ranky.GI [PCTools]
W32.HLLP.Sality [Symantec]
Virus.Win32.Sality.q [Kaspersky Lab]
PE_SALITY.AS-O [Trend Micro]
Virus.Win32.Sality [Ikarus]

 

Memory Modifications

Process NameProcess FilenameMain Module Size
[filename of the sample #1][file and pathname of the sample #1]200,704 bytes
amvo.exe%System%\amvo.exe200,704 bytes

 

Registry Modifications

 

Other details

URL to be downloadedFilename for the downloaded bits
http://www.om7890.com/mf2/help.rar%Temp%\help.rar

 

 

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.

Copyright © 2014 ThreatExpert. All rights reserved.