ThreatExpert Report: New Malware.al!enc

Submission Summary:

Submission details:

Submission received: 27 May 2009, 17:52:59
Processing time: 5 min 49 sec
Submitted sample:

File MD5: 0xB699636FD417371BA34AE9545658F2C4
File SHA-1: 0x6194E421CF7927C77ABCDB6802E68568097FA5DE
Filesize: 61,440 bytes
Alias: New Malware.al!enc [McAfee]

Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.
Uses the AppInit_DLLs value in order to install a module that will be loaded into the address space of every running application.

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%ProgramFiles%\ThunMail\testabd.dll	28,672 bytes	MD5: 0x3F1F13CD111C359D7A392D25F7BF01D3 SHA-1: 0xA14E8C395B3CF4984D14A88F00F84FF97853CE77	(not available)
2	%ProgramFiles%\ThunMail\testabd.exe [file and pathname of the sample #1]	61,440 bytes	MD5: 0xB699636FD417371BA34AE9545658F2C4 SHA-1: 0x6194E421CF7927C77ABCDB6802E68568097FA5DE	New Malware.al!enc [McAfee]
3	[file and pathname of the sample #1].bat	106 bytes	MD5: 0x15C40C44E7BD1D8F2DE38D9185F0B3F0 SHA-1: 0x59B3B619ED9B8F4A06AA5A09E81714049820855A	(not available)

Note:

%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following directory was created:

%ProgramFiles%\ThunMail

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
testabd.exe	%ProgramFiles%\thunmail\testabd.exe	65,536 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	65,536 bytes

Registry Modifications

The newly created Registry Value is:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

svc = "%ProgramFiles%\ThunMail\testabd.exe"

so that testabd.exe runs every time Windows starts

The following Registry Value was modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

AppInit_DLLs = "c:\progra~1\ThunMail\testabd.dll"

so that testabd.dll runs every time a Windows application starts

Other details

Analysis of the file resources indicate the following possible country of origin:

China

To mark the presence in the system, the following Mutex object was created:

2ï¿½Y

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.