Threat behavior
PWS:Win32/Ldpinch.CC is a member of Win32/Ldpinch - a family of trojans that steals sensitive information from affected machines and sends it to a remote attacker. In particular, Ldpinch variants target passwords for a comprehensive selection of FTP, chat and e-mail clients, as well as those stored in browsers and protected storage.
Installation
PWS:Win32/Ldpinch.CC runs from where it was first executed and does not install itself on the affected computer.
Payload
Steals sensitive information
PWS:Win32/Ldpinch.CC attempts to steal passwords from a number of different sources. It targets the following:
- Windows
Protected Storage
Passport.Net / WindowsLive credentials
Remote Access Service (RAS)
Remote Desktop Protocol (RDP) - Chat clients
ICQ
&RQ
QIP
Trillian
Gaim - Browsers
Opera
Mozilla Firefox - Mail clients
Mozilla Thunderbird
The Bat!
Outlook
Becky
Eudora - FTP clients
Total Commander / Windows Commander
FTP Commander
CuteFTP
WS_FTP
FileZilla
FlashFXP
FreeFTP
SmartFTP
Far FTP plugin - Rapidshare downloaders
RapGET
USDownloader
Win32/Ldpinch may also capture additional information regarding the affected computer, including the following:
- Computer name
- Running processes
- Connected drive properties
- Memory status
- Username
- Operating system ‘product’ id
Win32/Ldpinch sends the captured information to a remote attacker. While older variants of this family sent captured data using e-mail, recent variants (including this one) send captured data via HTTP to particular remote hosts (often to remote PHP scripts). PWS:Win32/Ldpinch.CC has been observed contacting PHP scripts at the following IP addresses for this purpose:
- 78.159.120.13
- 61.235.117.83
Analysis by Scott Molenkamp
Prevention