TR/PSW.PdP.CT.1.E.3 - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/PSW.PdP.CT.1.E.3
Date discovered:	17/03/2006
Type:	Trojan
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Medium
Static file:	Yes
File size:	24.302 Bytes
MD5 checksum:	741f81f6154bd5115028579dcb9da082
VDF version:	6.34.00.61 - Fri, 17 Mar 2006 05:53 (GMT+1)

General Method of propagation:
   • No own spreading routine

Alias:
   • Kaspersky: Trojan-Spy.Win32.Goldun.iw
   • VirusBuster: Rootkit.Agent.10
   • Bitdefender: Trojan.Spy.Goldun.IW

Platforms / OS:
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Registry modification
   • Steals information
   • Third party control

Files The following files are created:

– %SYSDIR%\axdebugl.dll Further investigation pointed out that this file is malware, too. Detected as: BDS/Haxdoor.GJ.1

– %SYSDIR%\axdebugld.sys Further investigation pointed out that this file is malware, too. Detected as: TR/PSW.PdP.CT.1.E.3

Registry The following registry keys are added in order to load the services after reboot:

– HKLM\SYSTEM\CurrentControlSet\Services\axdebugld
   • "Type"=dword:00000001
   • "Start"=dword:00000001
   • "ErrorControl"=dword:00000000
   • "ImagePath"="%SYSDIR%\axdebugl.sys"
   • "DisplayName"="OPENSSL cryptoapi"

– HKLM\SYSTEM\CurrentControlSet\Services\axdebugld\Security
   • "Security"=%hex values%

– HKLM\SYSTEM\CurrentControlSet\Services\axdebugld\Enum
   • "0"="Root\\LEGACY_AXDEBUGLD\\0000"
   • "Count"=dword:00000001
   • "NextInstance"=dword:00000001

– HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AXDEBUGLD
   • "NextInstance"=dword:00000001

– HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AXDEBUGLD\0000
   • "Service"="axdebugld"
   • "Legacy"=dword:00000001
   • "ConfigFlags"=dword:00000000
   • "Class"="LegacyDriver"
   • "ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
   • "DeviceDesc"="OPENSSL cryptoapi"

– HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AXDEBUGLD\0000\
   Control
   • "*NewlyCreated*"=dword:00000000
   • "ActiveService"="axdebugld"

The following registry key is added:

– HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
   axdebugl
   • "DllName"="axdebugl.dll"
   • "Startup"="axdebugl"
   • "Impersonate"=dword:00000001
   • "Asynchronous"=dword:00000001
   • "MaxWait"=dword:00000001
   • "nk48id"="[%hex number%]"

Backdoor Contact server:
The following:
   • servername1.com/**********

As a result it may send information and remote control could be provided. Besides, it periodically repeats the connection. This is done via the HTTP GET and POST method using a PHP script.

Sends information about:
    • Cached passwords
    • Collected information described in stealing section

Stealing It tries to steal the following information:
– Email account information obtained from the registry key: HKCU\Software\Microsoft\Internet Account Manager\Accounts

– Passwords from the following programs:
   • Miranda
   • Internet Explorer
   • Mozilla
   • Maxthon
   • The Bat
   • Msn
   • Icq
   • Opera

– A logging routine is started after a website is visited:
   • e-gold.com

Injection – It injects the following file into a process: axdebugl.sys

Process name:
• explorer.exe

File details Programming language:
The malware program was written in MS Visual C++.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

See a brief description here.

Description inserted by Sergiu Oprea on Mon, 10 Apr 2006 11:23 (GMT+1)
Description updated by Sergiu Oprea on Tue, 11 Apr 2006 10:48 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back