ThreatExpert Report: Trojan.Gen, Trojan.Win32.VB.advg, Generic Dropper!czu, Mal/Generic-L..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 7 May 2011, 08:34:21
Processing time: 8 min 16 sec
Submitted sample:

File MD5: 0xED8DB54695222B6F624CB167F240F3CD
File SHA-1: 0x7BED986BE7D8F4E05F8E286DB1CAAB3F6B145B6A
Filesize: 520,192 bytes
Alias:

Trojan.Gen [PCTools]
Trojan.Gen [Symantec]
Trojan.Win32.VB.advg [Kaspersky Lab]
Generic Dropper!czu [McAfee]
Mal/Generic-L [Sophos]
Trojan:Win32/Meredrop [Microsoft]
Trojan.Win32.VB [Ikarus]
Win-Trojan/Xema.variant [AhnLab]

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A program that downloads files to the local computer that may represent security risk

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%System%\core8.dll %System%\oobe\rule8\files\Base.inf [file and pathname of the sample #1]	520,192 bytes	MD5: 0xED8DB54695222B6F624CB167F240F3CD SHA-1: 0x7BED986BE7D8F4E05F8E286DB1CAAB3F6B145B6A	Trojan.Gen [PCTools] Trojan.Gen [Symantec] Trojan.Win32.VB.advg [Kaspersky Lab] Generic Dropper!czu [McAfee] Mal/Generic-L [Sophos] Trojan:Win32/Meredrop [Microsoft] Trojan.Win32.VB [Ikarus] Win-Trojan/Xema.variant [AhnLab]
2	%System%\oobe\Dis8.dll	62 bytes	MD5: 0x7457A5DF1FF47C957ACF1FA000D7D9AD SHA-1: 0x69D2BBA827FD4DE0169419A0FDA280252B348514	(not available)
3	%System%\oobe\Drvn8.dll	318 bytes	MD5: 0xE8CC6828C2998E1EF998C67FFDF4580D SHA-1: 0x2726B049E79DE24634820EE391C8BB2167257FB3	(not available)
4	%System%\oobe\rule8\desktop.ini	65 bytes	MD5: 0x5079E25C0E9F1B5640B856225F5F5560 SHA-1: 0x1DB3FDFC0610ECCCD99EE00F65A9541061F1A357	(not available)
5	%System%\oobe\rule8\files\csrss.exe	225,280 bytes	MD5: 0x4D361776ED2E55CE0DA9DBE4F92D8AE2 SHA-1: 0x4B1B8BC9DDBE05A92F5EBECBF1EFCAF908A32E6F	Trojan.Adclicker!rem [PCTools] Trojan.Adclicker [Symantec] Trojan-Downloader.Win32.VB.xdi [Kaspersky Lab] Generic Downloader.x!dzb [McAfee] Mal/Generic-L [Sophos] Trojan:Win32/Sisron [Microsoft] Trojan-Downloader.Win32.VB [Ikarus] Win-Trojan/Xema.variant [AhnLab]
6	%System%\oobe\speed8.dll %System%\Restore\ranback.dll	221 bytes	MD5: 0x7742F1F3F8900E7FDFBC776CF73897B6 SHA-1: 0x96C4D637F768033E72882EC86C5F0C56279938EA	Trojan.Win32.AutoRun.aod [Kaspersky Lab] Mal/AutoInf-C [Sophos] Trojan.Win32.AutoRun [Ikarus]

Note:

%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following directories were created:

%System%\oobe\rule8
%System%\oobe\rule8\files

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
csrss.exe	%System%\oobe\rule8\files\csrss.exe	225,280 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\K_O_G8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\K_O_G8\KMCounter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\K_O_G8\KMDest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\K_O_G8\KMFItemp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\K_O_G8\KMFIX
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\K_O_G8\KMIN
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\K_O_G8\KMSEC

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]

KM_Path8 = "%System%\oobe\rule8\files\csrss.exe"
KM_Path7 = "SorryKamba"
KM_Path4 = "SorryKamba"
KM_Path3 = "SorryKamba"
KM_Path2 = "SorryKamba"
KM_Path = "SorryKamba"

so that csrss.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]

NoDriveTypeAutoRun = 31 34 35

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\K_O_G8\KMSEC]

Value = "2D3A42554B1158393D574655"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\K_O_G8\KMIN]

ByUser = "%UserName%"
KMVer = "3.8"
KMVerName = "KOG"
KMState = "1"
restart = ""
restart2 = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\K_O_G8\KMFIX]

Tstadmn = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\K_O_G8\KMFItemp]

key = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\K_O_G8\KMDest]

I = "5A5A4C565A5E4B565354564F5F"
cnt = "3E23312C2E29582B3F2C2C3D38"
cty = "2F2C34342A3E"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\K_O_G8\KMCounter]

Value = "1"

Other details

Analysis of the file resources indicate the following possible country of origin:

Egypt

There were registered attempts to establish connection with the remote hosts. The connection details are:

Remote Host	Port Number
70.86.96.219	80
74.125.65.132	80
74.200.243.251	80

The data identified by the following URLs was then requested from the remote web server:

http://www.ip2location.com/
http://adversion8.blogspot.com/
http://adversion7.blogspot.com/
http://www.kogpage.blogspot.com/
http://doniablog.wordpress.com/

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.