TR/NSAnti.B.9 - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/NSAnti.B.9
Date discovered:	01/08/2006
Type:	Trojan
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Low to medium
Static file:	Yes
File size:	28.816 Bytes
MD5 checksum:	051c235f29cb1d2d0Ebc499df81e83e9
VDF version:	6.35.01.29 - Tue, 01 Aug 2006 06:39 (GMT+1)
IVDF version:	6.35.01.29 - Tue, 01 Aug 2006 06:39 (GMT+1)

General Method of propagation:
   • No own spreading routine

Aliases:
   • Symantec: Infostealer.Lineage
   • Kaspersky: Trojan-PSW.Win32.QQPass.hd
   • Bitdefender: Trojan.NSAnti.B

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Drops a file
   • Drops a malicious file
   • Records keystrokes
   • Registry modification
   • Steals information

Files It copies itself to the following location:
• %SYSDIR%\SVCH0ST.EXE

The following files are created:

– %SYSDIR%\mmdat.dat This is a non malicious text file with the following content:
• %malware execution directory%\%executed file%

– %SYSDIR%\ntdll32.dll Further investigation pointed out that this file is malware, too. Detected as: TR/Spy.Agent.ct.4.A

Registry The following registry key is added in order to run the process after reboot:

– HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
• "SVCHOST"="%SYSDIR%\SVCH0ST.EXE"

The following registry key is added:

– HKCR\exefile\shell\open\command
• "(Default)"="%SYSDIR%\SVCH0ST.EXE %1 %*"

Email It doesn't have its own spreading routine but it has the ability to send an email. It is most likely that the receiver is the author. The characteristics are described below:

From:
The sender address is spoofed.
The sender of the email is the following:
   • 96262@96262.net <96262@96262.net>

To:
The recipient of the email is the following:
   • 665951@QQ.com <665951@QQ.com>

Subject:
The following:
   • %random character string%

Body:

   • %stolen information%

The email looks like the following:

Stealing It tries to steal the following information:
– Passwords typed into 'password input fields'

– It captures:
• Window information

Miscellaneous It creates the following Mutexes:
• "MimaThief"
• "MMSHARED"

File details Programming language:
The malware program was written in MS Visual C++.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

See a brief description here.

Description inserted by Marius T. Nicolae on Wed, 09 Aug 2006 11:54 (GMT+1)
Description updated by Marius T. Nicolae on Wed, 23 Aug 2006 15:47 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back