Trojan-PSW.Win32.LdPinch.azw

Technical Details

This Trojan is designed to steal confidential information (user passwords). It is designed to steal a range of confidential information.

It is a Windows PE EXE file. It is 24,384 bytes in size. It is packed using MEW. The unpacked file is approximately 340KB in size. It is written in Assembler.

Payload

Once launched, the Trojan adds the following entry to the system registry:

The Trojan harvests information about the hard disk, how much free space remains on the disk, the current user’s account, the network name of the victim machine, the version of the operating system, the type of processor, screen options, programs installed on the computer, active processes and dial-up connections.

The Trojan constantly searches for windows of the following classes: “AVP.AlertDialog”, “AVP.AhAppChangedDialog”, “AVP.AhLearnDialog”. Within these windows it will emulate clicking on the following buttons: "Razreshit [‘Allow' in Russian]”, “Allow”, “Skip”, “Sozdat’ pravilo [‘Create Rule’ in Russian]“, “Apply to all”, “Remember this action”. It will close windows of the class “AVP.Product_Notification”.

The Trojan constantly searches for windows where the title contains the following strings: "Kaspersky Anti-Hacker - Sozdat’ pravilo dlya” or “Kaspersky Anti-Hacker - Create a rule for” and emulates clicking on "Razreshit odnokratno" or "Allow Once" (the Russian and English terms are equivalent).

The Trojan also emulates clicking on “OK” in windows with the following titles:

The Trojan searches for the following files:

In the following folders:

It also searches folders indicated in the following registry key parameters for these files:

It will harvest the contents of these files.

The Trojan gets the path to the Mirabilis ICQ client (if installed), searches for files with a DAT extension and harvests their contents. Revert the system registry key values.

The Trojan reads the path to the Miranda client (if installed) from the following registry section:

searches it for files with a DAT extension and harvest their contents.

The Trojan also searches the following registry key’s parameters:

for parameters called RQ.exe and RAT.exe. and uses them to search for a file called andrq.ini.

If it does not find these files, it gets the value from the following registry key:

and uses it to search for a file called andrq.ini.

The Trojan gets the path to the file with the Trillian client (if installed) from the following registry key:

It reads the contents of users\global\profiles.ini, and extracts information about the current user profile. It also reads the user name and password from aim.ini.

The Trojan gets the path to Total Commander (if installed) from the following registry keys:

from this folder. It will also scan %WinDir% for a file called wcs_ftp.ini. he Trojan also searches <folder where Windows Commander is located>\Profiles\Prof\ftp.ini. The Trojan scans these files for the following parameters, and gets their values:

The Trojan gets the path to the folder from the following registry key:

It searches for a file called Mailbox.ini, searches for the following parameters, and gets their values:

The Trojan gets a list of entries in the address book, and passwords to Microsoft Outlook accounts from the following registry key:

The Trojan gets the patch to CuteFTP and CuteFTP Professional (if installed) and searches them for the following files:

It will harvest the contents of these files.

The Trojan gets the values of the following parameters from %WinDir%\edialer.ini:

The Trojan gets a list of keys in [HKCU\Software\Far\Plugins\FTP\Hosts] and gets the values of the following parameters:

The Trojan reads the path to the Opera client (if installed) and searches both its folder, and the path shown below

for a file called \profile\wand.dat. It harvests the contents of this file.

for a file called \profile\wand.dat. It harvests the contents of this file.

The Trojan gets the path to QIP (if installed) from the following registry key:

It searchs the program folder, the subfolder Users and all folders in the subfolder for Config.ini. It gets the values for:

The Trojan reads the contents of %UserProfile %\ \Application Data\Thunderbird\Profiles.ini and extracts a path to profiles, where it will search for files called signons.txt and prefs.js, and harvest their contents.

The Trojan gets the values of all subkeys of the following registry key:

The Trojan reads the following parameters from %UserProfile%\Application Data\Qualcomm\Eudora\Eudora.ini:

The Trojan reads the path to Punto Switcher (if installed) from the following registry key:

and reads the contents of "diary.dat".

It reads the value of %UserProfile%\Application Data\gaim\accounts.xml

The Trojan harvests the contents of files located in the Firefox profiles.

The Trojan gets the path to the folder with FileZilla (if installed) from the following registry key:

and harvests the contents of FileZilla.xml

The Trojan gets the path to the folder with FlashFXP (if installed) and harvests the contents of Sites.dat.

It harvests the contents of the following files:

It also harvests the contents of the following files:

It harvests the following values:

from the following registry subkey:

The Trojan reads the value of the following registry key parameter:

and uses it to search for the files listed below:

It harvests the contents of these files.

The Trojan reads the value of the following registry key parameter:

and uses it to search for the files listed below:

It harvests the contents of these files.

The Trojan searches %UserProfile%\Moi dokumenti [My Documents in Russian] for files with an .rdp extension and harvests their contents.

The Trojan sends a report containing all harvested data to the remote malicious user by email. xakep_****fakep@mail.ru.

In order to send messages, the Trojan sends a request to the following address; http://***mailserver.net/2333/gate.php. The body of the message is transmitted in the request.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Delete the Trojan process.
2. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
3. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).