Trojan-PSW.Win32.LdPinch.rn

Technical Details

This Trojan belongs to a family of Trojans written with the aim of stealing user passwords. LdPinch is designed to steal confidential information. The Trojan itself is a Windows PE EXE file approximately 17KB in size, packed using UPX.

When installing, the Trojan copies itself to the Windows system directory as “svc.exe”:

%System%\svc.exe

It then registers this file in the system registry, ensuring that the Trojan file will be executed each time Windows is rebooted on the victim machine.

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"System" = "%System%\svc.exe"

The Trojan harvests information about the infected system, and login names and passwords for a range of services and applications, including AOL Instant Messenger and ICQ.

This information is then sent to the remote malicious user by email.

The Trojan will also send a link pointing to its own file to all contacts in the ICQ contact list.

It will terminate a range of processes connected with firewalls and antivirus solutions.