Submission Summary: Submission details: Submission received: 8 March 2011, 01:08:27 Processing time: 10 min 58 sec Submitted sample: File MD5: 0xFF061CC088BD21ED382A512C54B9158C File SHA-1: 0xA182B74A99B1865B5E5B7A0FE25BE25CBE3CAFE7 Filesize: 262,656 bytes Alias: Trojan.Win32.Koblu Summary of the findings: What's been found Registers a Winlogon notification package so that the installed module is loaded into the address space of winlogon.exe. Severity Level [Ikarus]
Technical Details:
File System Modifications
The following files were created in the system: # Filename(s) 1 %Temp%\[filename of the sample #1 without extension].bat File Size 108 bytes File Hash MD5: 0x67FC3FCA5DB3AAFA5EF64E2D034F584E SHA-1: 0x572E62F1F2331C3BCBA7ECA8B442E088C3F455C7 MD5: 0xB1031990B4FECAAF1AA5C48932505300 SHA-1: 0xF7563F2E31F629970F4762BD5447E2B5A3FEA23C Alias (not available)
2 %System%\itlnfw32.dll 35,840 bytes
(not available)
3 %System%\itlpfw32.dll 211,968 MD5: 0x752199121E9CBBF6D582EE21DBD8DB1E (not available) bytes SHA-1: 0x0BC70BEFC9D6FC26A1BBFBAB94105D31D7DEA659 4 [file and pathname of the sample #1] 262,656 MD5: 0xFF061CC088BD21ED382A512C54B9158C bytes SHA-1: 0xA182B74A99B1865B5E5B7A0FE25BE25CBE3CAFE7 Trojan.Win32.Koblu [Ikarus]
Notes: %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP). %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
Memory Modifications The following module was loaded into the address space of other process(es): Module Name Module Filename itlpfw32.dll Address Space Details
%System%\itlpfw32.dll Process name: svchost.exe Process filename: %System%\svchost.exe Address space: 0x860000 - 0x899000
There was a new service created in the system: Service Name Display Name itlperf Status Service Filename
Intel CPU Perfermons "Running" %System%\svchost.exe -k itlsvc
Registry Modifications The following Registry Keys were created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\itlnfw32 HKEY_LOCAL_MACHINE\SOFTWARE\Intel HKEY_LOCAL_MACHINE\SOFTWARE\Intel\Perfermence HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ITLPERF HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ITLPERF\0000 HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ITLPERF\0000\Control HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\itlperf HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\itlperf\Parameters HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\itlperf\Security HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\itlperf\Enum HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ITLPERF HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ITLPERF\0000 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ITLPERF\0000\Control HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\itlperf HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\itlperf\Parameters HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\itlperf\Security HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\itlperf\Enum The newly created Registry Values are: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost] itlsvc = "itlperf" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\itlnfw32] Asynchronous = 0x00000001 DllName = "itlnfw32.dll" Impersonate = 0x00000000 Enabled = 0x00000001 Logon = "WlLogonEvent" Startup = "WlStartupEvent" so that itlnfw32.dll is installed as a Winlogon notification package [HKEY_LOCAL_MACHINE\SOFTWARE\Intel\Perfermence] Pwd = "35242350" Installer = "BKjv0LJNjTaeRtX8Set6boFYacPVlLRWWoBjvErU7LM=" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ITLPERF\0000\Control]
All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert. The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further ThreatExpert does not warrant , or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise. Copyright 2011 ThreatExpert. All rights reserved.
![[6]](https://imgv2-2-f.scribdassets.com/img/document/380614386/149x198/87ee200f47/1527729686?v=1)
