Virus:TR/PSW.Magania.avwf
Date discovered:04/03/2009
Type:Trojan
In the wild:Yes
Reported Infections:Low
Distribution Potential:Medium
Damage Potential:Medium to high
Static file:Yes
File size:108.412 Bytes
MD5 checksum:518db8564203cc90b7a461d71c42dd09
IVDF version:7.01.02.119 - Wednesday, March 4, 2009

 General Methods of propagation:
   • Mapped network drives
   • Messenger


Aliases:
   •  Symantec: Trojan.Dropper
   •  Sophos: W32/AutoRun-AAT
   •  Panda: W32/Lineage.KPH
   •  Grisoft: PSW.OnlineGames.2.S
   •  Eset: Win32/PSW.OnLineGames.NMY


Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003


Side effects:
   • Downloads a malicious file
   • Drops malicious files
   • Lowers security settings
   • Registry modification

 Files It copies itself to the following locations:
   • %SYSDIR%\ierdfgh.exe
   • %drive%\9.exe



It deletes the initially executed copy of itself.



It deletes the following file:
   • %SYSDIR%\drivers\cdaudio.sys



It may corrupt the following file:
   • %SYSDIR%\drivers\cdaudio.sys



The following files are created:

– %drive%\autorun.inf This is a non malicious text file with the following content:
   • %code that runs malware%

– %SYSDIR%\pytdfse%number%.dll Further investigation pointed out that this file is malware, too. Detected as: TR/Autorun.845034

– %SYSDIR%\drivers\klif.sys Detected as: TR/Klif.3520

– %drive%\6fq.com
– %TEMPDIR%\4tddfwq0.dll
– %TEMPDIR%\xvassdf.exe



It tries to download a file:

– The location is the following:
   • http://vfbgt.com/xrbv/**********


– The location is the following:
   • http://sfdght.com/xrbv/**********
Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too.

 Registry One of the following values is added in order to run the process after reboot:

–  [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • "kxswsoft"="%SYSDIR%\ierdfgh.exe"



The following registry keys are added in order to load the service after reboot:

– [HKLM\SYSTEM\CurrentControlSet\Services\AVPsys]
   • "Type"=dword:00000001
     "Start"=dword:00000003
     "ErrorControl"=dword:00000001
     "ImagePath"="\??\%SYSDIR%\drivers\klif.sys"
     "DisplayName"="AVPsys"



The values of the following registry key are removed:



The following registry key including all values and subkeys is removed:
   • [HKLM\SYSTEM\CurrentControlSet\Services\AVPsys]



The following registry keys are added:

– [HKLM\SYSTEM\CurrentControlSet\Services\AVPsys\Enum]
   • "Count"=dword:00000000
   • "NextInstance"=dword:00000000
   • "INITSTARTFAILED"=dword:00000001

– [HKLM\SYSTEM\CurrentControlSet\Services\AVPsys\Security]
   • "Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
   • 00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
   • 00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
   • 05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
   • 20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\
   • 00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
   • 00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00



The following registry keys are changed:

– [HKLM\SOFTWARE\KasperskyLab\protected\AVP7\profiles\Updater]
   New value:
   • "enabled"=dword:00000000

Various Explorer settings:
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
   New value:
   • "NoDriveTypeAutoRun"=dword:00000091

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
   Folder\Hidden\SHOWALL]
   New value:
   • "CheckedValue"=dword:00000001

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
   New value:
   • "ShowSuperHidden"=dword:00000001
     "Hidden"=dword:00000002

 Messenger It is spreading via Messenger. The characteristics are described below:

– Yahoo Messenger


Propagation via file
It sends a file with one of the following filenames:
   • YahooWidgetEngine.exe
   • YPagerj.exe

 Injection –  It injects the following file into a process: %SYSDIR%\pytdfse%number%.dll


– It injects a process watching routine into a process.

    Process name:
   • explorer.exe

   If the malware fails, it continues running as a process.

 Rootkit Technology It is a malware-specific technology. The malware hides its presence from system utilities, security applications and in the end, from the user.


Method used:
    • Hidden from Windows API
    • Hidden from Interrupt Descriptor Table (IDT)

 File details Programming language:
 The malware program was written in MS Visual C++.


Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

Description inserted by Petre Galan on Monday, July 6, 2009
Description updated by Petre Galan on Wednesday, August 19, 2009

Back . . . .