Submission Summary:

• Submission details:
• Submission received: 1 November 2011, 01:29:04
• Processing time: 12 min 20 sec
• Submitted sample:
• File MD5: 0xD6B9250BC52DF4C077642C7BCEAD8C92
• File SHA-1: 0xC1B02E2484DEF481DEF708DBF3928320187C798A
• Filesize: 531,968 bytes
• Alias:
• IM-Worm.Win32.Sohanad.bm [Kaspersky Lab]
• W32/YahLover.worm.gen [McAfee]
• W32/SillyFDC-G [Sophos]
• IM-Worm.Win32.Sohanad [Ikarus]
• Win32/Hakaglan.worm.462264 [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Modifies some system settings that may have negative impact on overall system security state.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk

Description

Worm.IM.Sohanad

Worm.IM.Sohanad spreads via Yahoo Messenger and infects Windows. It sends a message to all Yahoo Messenger contacts of an infected user. The message contains a link enticing users to download the worm. The worm also disable certain Windows functionalities abd hijacks Internet Explorer homepage. It also downloads other maware and it will also attempt to propagate via the means of creating copies of itself onto removable devices such as USB flash and hard drives.

• Attention! The following threat category was identified:

Threat Category	Description
	A network-aware worm that attempts to replicate across the existing network(s)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Windir%\RVHOST.exe %System%\RVHOST.exe [file and pathname of the sample #1]	531,968 bytes	MD5: 0xD6B9250BC52DF4C077642C7BCEAD8C92 SHA-1: 0xC1B02E2484DEF481DEF708DBF3928320187C798A	IM-Worm.Win32.Sohanad.bm [Kaspersky Lab] W32/YahLover.worm.gen [McAfee] W32/SillyFDC-G [Sophos] IM-Worm.Win32.Sohanad [Ikarus] Win32/Hakaglan.worm.462264 [AhnLab]
2	%System%\setting.ini	1,248 bytes	MD5: 0xD91CE6304025D69F66F5866908A87A82 SHA-1: 0xD045705CC12FF0E0D1C8E8E9499197CB22730D2D	(not available)
3	%Windir%\Tasks\At1.job	346 bytes	MD5: 0x1E3D4CE90DCDB740C2DF2B36ADE6533E SHA-1: 0x4140581223AE32269403467A7609D351D063600C	(not available)
4	%Windir%\Tasks\At2.job	346 bytes	MD5: 0x34470E951325FBE140570E7B702EEE34 SHA-1: 0x9048F1301823195C87BB182368D37AFBD294697C	(not available)

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	696,320 bytes
RVHOST.exe	%System%\rvhost.exe	696,320 bytes
RVHOST.exe	%Windir%\rvhost.exe	696,320 bytes

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
• NofolderOptions = 0x00000001

to remove the Folder Options item from all Windows Explorer menus and from Control Panel

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
• DisableTaskMgr = 0x00000001
• DisableRegistryTools = 0x00000001

to prevent users from starting Task Manager (Taskmgr.exe)
to disable the Windows registry editors (Regedt32.exe and Regedit.exe)

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• Yahoo Messengger = "%System%\RVHOST.exe"

so that RVHOST.exe runs every time Windows starts

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
• Shell =

Other details

• Analysis of the file resources indicate the following possible country of origin:

	United Kingdom

• The following port was open in the system:

• There was registered attempt to establish connection with the remote host. The connection details are:

• The data identified by the following URL was then requested from the remote web server:
• http://nhatquanglan2.0catch.com/setting.nql