TR/PSW.LdPinch.TR - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/PSW.LdPinch.TR
Date discovered:	15/09/2005
Type:	Trojan
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Medium
Static file:	Yes
File size:	11.515 Bytes
MD5 checksum:	2f17eccf5467baa56eb6b9fcd31bd721
VDF version:	6.31.1.204

General Method of propagation:
   • No own spreading routine

Aliases:
   • TrendMicro: TSPY_LDPINCH.AB
   • F-Secure: W32/Ldpinch.RU
   • VirusBuster: Trojan.PWS.LdPinch.CY
   • Bitdefender: Trojan.PWS.LdPinch.TR

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Drops a malicious file
   • Registry modification
   • Steals information

Files It copies itself to the following location:
• %WINDIR%\svchost.exe

– c:\pass.bin This file contains collected information about the system.

Registry The following registry key is added in order to run the process after reboot:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
• "MStask"="%WINDIR%\svchost.exe"

Email It doesn't have its own spreading routine but it has the ability to send an email. It is most likely that the receiver is the author. The characteristics are described below:

To:
The recipient of the email is the following:
• axelefppro@gmail.com

The attachment is a copy of the created file: c:\pass.bin

Stealing It tries to steal the following information:
– Email account information obtained from the registry key: HKCU\Software\Microsoft\Internet Account Manager\Accounts

– Passwords from the following programs:
   • Windows Commander
   • CuteFTP
   • WS_FTP
   • Outlook
   • Opera
   • Mozilla
   • BatMail
   • Trillian
   • ICQ
   • E Dialer
   • FAR Manager

File details Programming language:
The malware program was written in MS Visual C++.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• MEW 11

See a brief description here.

Description inserted by Catalin Jora on Thu, 15 Sep 2005 10:23 (GMT+1)
Description updated by Catalin Jora on Thu, 15 Sep 2005 14:40 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back