ThreatExpert Report: not-a-virus:Monitor.Win32.Ardamax.vl, Spy-Agent.cv, TrojanSpy:Win32/Ardamax.H..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 9 October 2011, 23:42:51
Processing time: 10 min 30 sec
Submitted sample:

File MD5: 0xC8167D5600A452D12EB1C0F53D4886A7
File SHA-1: 0xE68ED8B1FD575ED966C148CFF99253E7B93612E0
Filesize: 514,821 bytes
Alias:

not-a-virus:Monitor.Win32.Ardamax.vl [Kaspersky Lab]
Spy-Agent.cv [McAfee]
TrojanSpy:Win32/Ardamax.H [Microsoft]
Trojan-Spy.Win32.Ardamax [Ikarus]
Win-Trojan/Ardamax.14848.D [AhnLab]

Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Application.Ardamax_Keylogger	Ardamax Keylogger is a keystroke recorder that captures user's activity and saves it to an encrypted log file. The log file can be viewed with the powerful Log Viewer.
Trojan-Dropper.Agent	Trojan-Dropper.Agent attempts to drop a malicious file and run it on the compromised computer.

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\@2.tmp	906,276 bytes	MD5: 0xEBCCC7BF45AD200218EB158534C0F42E SHA-1: 0x61C641195B570D8D42F1E70EAC0DA832102AEE63	Virus.Win32.Ardamax [Ikarus]
2	%System%\28463\AKV.exe	404,480 bytes	MD5: 0xB8FA30233794772B8B76B4B1D91C7321 SHA-1: 0x0CF9561BE2528944285E536F41D502BE24C3AA87	not-a-virus:Monitor.Win32.Ardamax.w [Kaspersky Lab] Keylog-Ardamax.dll [McAfee] Mal/Generic-A [Sophos] MonitoringTool:Win32/Ardamax [Microsoft] not-a-virus:Monitor.Win32.Ardamax.ah [Ikarus] Win-Trojan/Ardamax.404480 [AhnLab]
3	%System%\28463\OPVW.001	464 bytes	MD5: 0x968B58B19843AF08777DCEFEDD558DF5 SHA-1: 0x88552F5546F6ABE9807F9ADCAEDACD2B2AF948ED	(not available)
4	%System%\28463\OPVW.002	1,056 bytes	MD5: 0xE3C712AADAF9D7B28420BD80112E96FC SHA-1: 0xBA5526365A7FC38D860490BAB1B17786A8934F8F	(not available)
5	%System%\28463\OPVW.006	8,192 bytes	MD5: 0x43F02E9974B1477C1E6388882F233DB0 SHA-1: 0xF3E27B231193F8D5B2E1B09D05AE3A62795CF339	not-a-virus:Monitor.Win32.Ardamax.s [Kaspersky Lab] Keylog-Ardamax.dll [McAfee] MonitoringTool:Win32/Ardamax [Microsoft] not-a-virus:Monitor.Win32.Ardamax [Ikarus] Win-Trojan/Ardamax.7680 [AhnLab]
6	%System%\28463\OPVW.007	5,632 bytes	MD5: 0xB5A87D630436F958C6E1D82D15F98F96 SHA-1: 0xD3FF5E92198D4DF0F98A918071ACA53550BF1CFF	not-a-virus:Monitor.Win32.Ardamax.o [Kaspersky Lab] Keylog-Ardamax.dll [McAfee] TrojanSpy:WinNT/Ardamax.A!sys [Microsoft] not-a-virus:Monitor.Win32.Ardamax [Ikarus]
7	%System%\28463\OPVW.exe	484,864 bytes	MD5: 0x17535DDDECF8CB1EFDBA1F1952126547 SHA-1: 0xA862A9A3EB6C201751BE1038537522A5281EA6CB	not-a-virus:Monitor.Win32.Ardamax.ac [Kaspersky Lab] Keylog-Ardamax.dll [McAfee] MonitoringTool:Win32/Ardamax [Microsoft] Trojan-Spy.Ardamax.J [Ikarus] Win-Trojan/Ardamax.484864 [AhnLab]
8	[file and pathname of the sample #1]	514,821 bytes	MD5: 0xC8167D5600A452D12EB1C0F53D4886A7 SHA-1: 0xE68ED8B1FD575ED966C148CFF99253E7B93612E0	not-a-virus:Monitor.Win32.Ardamax.vl [Kaspersky Lab] Spy-Agent.cv [McAfee] TrojanSpy:Win32/Ardamax.H [Microsoft] Trojan-Spy.Win32.Ardamax [Ikarus] Win-Trojan/Ardamax.14848.D [AhnLab]

Notes:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following directory was created:

%System%\28463

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
OPVW.exe	%System%\28463\OPVW.exe	503,808 bytes

Attention! The following process was intentionally hidden from the user:

Process Name	Main Module Size
OPVW.exe	503,808 bytes

Registry Modifications

The newly created Registry Value is:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

OPVW Agent = "%System%\28463\OPVW.exe"

so that OPVW.exe runs every time Windows starts

Other details

Analysis of the file resources indicate the following possible country of origin:

Russian Federation

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.