TR/Drop.LdPinch.dvx - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/Drop.LdPinch.dvx
Date discovered:	23/10/2007
Type:	Trojan
Subtype:	Dropper / Downloader
In the wild:	Yes
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Low to medium
Static file:	Yes
File size:	28.672 Bytes
MD5 checksum:	67f88bf5ae4a4c64dbee3de00Dc8fc0C
IVDF version:	7.0.0.125

General Method of propagation:
   • No own spreading routine

Aliases:
   • Mcafee: Spy-Agent.bg
   • Eset: Win32/PSW.LdPinch.DVX trojan

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Downloads a file
   • Drops a malicious file

Files It copies itself to the following location:
• %WINDIR%\9129837.exe

The following files are created:

– %WINDIR%\new_drv.sys Furthermore it gets executed after it was fully created. Further investigation pointed out that this file is malware, too. Detected as: RKIT/LdPinch.dvx

– c:\abcdefg.bat Furthermore it gets executed after it was fully created. This batch file is used to delete a file.

Registry One of the following values is added in order to run the process after reboot:

– HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ttool
   • %WINDIR%\9129837.exe

The following registry key is added:

– HKCU\Software\Microsoft\InetData
   • k1=dword:336602d5
   • k2=dword:4337c861
   • version="951"

Backdoor Contact server:
The following:
• http://**********/cgi-bin/options.cgi?user_id=165549058&version_id=951&passphrase=fkjvhsdvlksdhvlsd&socks=3633&version=124&crc=00000000

As a result it may send some information. This is done via the HTTP GET request on a CGI script.

See a brief description here.

Description inserted by Lutz Koch on Tue, 23 Oct 2007 16:29 (GMT+1)
Description updated by Lutz Koch on Wed, 24 Oct 2007 12:31 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back