Submission Summary:

• Submission details:
• Submission received: 2 May 2009, 07:21:49
• Processing time: 6 min 50 sec
• Submitted sample:
• File MD5: 0xF31B3D71C3D88904E5C3A6B04BDEA033
• File SHA-1: 0x9EFF5AE8E0CDFF4E0776CD841094C22A5565EE64
• Filesize: 35,345 bytes
• Alias:
• Trojan-PSW.Nilage!sd5 [PCTools]
• Infostealer.Gampass [Symantec]
• Trojan-GameThief.Win32.Nilage.bft [Kaspersky Lab]
• PWS-Mmorpg.gen [McAfee]
• Mal_MLWR-1 [Trend Micro]
• Mal/Behav-204, Mal/EncPk-F [Sophos]
• PWS:Win32/Frethog.AK [Microsoft]
• Trojan-PWS.Win32.OnLineGames [Ikarus]
• Win-Trojan/LineageHack.35345 [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Trojan-PWS.OnlineGames.KW	Trojan.PSW.OnlineGames.KW monitors online games such as World of Warcraft to steal password information.
Trojan.PWStealer	Common Components shared between password stealing trojans such as Trojan.PSW.Hangame and Trojan.PWSteal.Lineage.
Trojan-PSW.Nilage!sd5	Trojan-PSW.Nilage!sd5 is a malicious application that attempts to steal passwords, login details, and other confidential information.
Trojan-PWS.OnlineGames.FB	Trojan.PSW.OnlineGames.FB is a Trojan that will start itself automatically and steal passwords of onlinegames on the infected machines.

• Attention! The following threat category was identified:

Threat Category	Description
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%System%\LgSyl.dll %System%\MgSyl.dll	14,336 bytes	MD5: 0x1C954FC9BB8FCAD891BF05551F353434 SHA-1: 0x282AACA7377F10F4FB0019303A7CEBA307D28672	Trojan-PWS.OnlineGames.KW [PCTools] Infostealer.Gampass [Symantec] Trojan-GameThief.Win32.Nilage.bft [Kaspersky Lab] PWS-LegMir.dll [McAfee] Mal_OLGM-3 [Trend Micro] Troj/Lineag-Gen, Troj/Lineag-Gen, Troj/Lineag-Gen, Mal/Gampass-B, Mal/Emogen-R [Sophos] PWS:Win32/Nilage [Microsoft] Win32.SuspectCrc [Ikarus] Win-Trojan/LineageHack.14336.AG [AhnLab] packed with UPX [Kaspersky Lab]
2	[file and pathname of the sample #1] %Windir%\winlog0n.exe	35,345 bytes	MD5: 0xF31B3D71C3D88904E5C3A6B04BDEA033 SHA-1: 0x9EFF5AE8E0CDFF4E0776CD841094C22A5565EE64	Trojan-PSW.Nilage!sd5 [PCTools] Infostealer.Gampass [Symantec] Trojan-GameThief.Win32.Nilage.bft [Kaspersky Lab] PWS-Mmorpg.gen [McAfee] Mal_MLWR-1 [Trend Micro] Mal/Behav-204, Mal/EncPk-F [Sophos] PWS:Win32/Frethog.AK [Microsoft] Trojan-PWS.Win32.OnLineGames [Ikarus] Win-Trojan/LineageHack.35345 [AhnLab]

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
winlog0n.exe	%Windir%\winlog0n.exe	77,824 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	77,824 bytes

• The following modules were loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
LgSyl.dll	%System%\LgSyl.dll	Process name: winlog0n.exe Process filename: %Windir%\winlog0n.exe Address space: 0x320000 - 0x32D000
MgSyl.dll	%System%\MgSyl.dll	Process name: winlog0n.exe Process filename: %Windir%\winlog0n.exe Address space: 0x320000 - 0x32D000

Registry Modifications

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• 9frz2418bs0 = "%Windir%\winlog0n.exe"

so that winlog0n.exe runs every time Windows starts

Other details

• There were application-defined hook procedures installed into the hook chain (e.g. to monitor keystrokes). The installed hooks are handled by the following modules:
• %System%\LgSyl.dll
• %System%\MgSyl.dll