F-Secure Trojan Information Pages : HaxSpy.AB [ Summary ] | [ Detailed Description ] | [ Detection ] Name: HaxSpy.AB Alias: W32/HaxSpy.AB.dr, Trojan-Spy.WIn32.Haxspy.ab, W32/HaxSpy.AB Type: Spy Category: Trojan Platform: Win32 Date of Discovery: May 24, 2006 Summary We received several reports about a suspicious German message with an attached ZIP archive on May 24th, 2006. The archive contained a trojan dropper for a new variant of a stealthy HaxSpy spying trojan. Detailed Description The message that the trojan dropper was spreading with looks like the following: Subject: Betrag uberwiesen Body: Hallo, wie gestern abgesprochen habe ich den Betrag 1967, 83 auf dein Konto überwiesen. Ich denke, das Geld muss schon übermorgen bei Dir sein. Im Anhang habe ich den gescannten Nachweis angeheftet. Ich hoffe, daß alle Daten korrekt sind. Bitte gebe mir kurz Bescheid. Lieber Gruß Attachment: hc.zip The ZIP archive contains an executable file with the hc.exe name. This file is the dropper for the two HaxSpy trojan components. After the trojan's file is run, it drops 2 files to the Windows System folder: nkgfs.sys nkunpack.dll The SYS file is a rootkit driver that hides the trojan's files and the DLL file is the main spying component. It is registered as a system component (Winlogon\Notify entry in the Registry) and, being active, collects the following information and sends it back to the hacker: Inetcomm server passwords POP and IMAP server names, logins and passwords The Bat passwords Internet Explorer Protected Storage passwords The trojan modifies Windows firewall settings and blocks access to the following websites: avp.ch customer.symantec.com dispatch.mcafee.com download.mcafee.com downloads1.kaspersky-labs.com downloads1.kaspersky-labs.com downloads1.kaspersky-labs.com downloads2.kaspersky-labs.com avp.com avp.ru awaps.net downloads3.kaspersky-labs.com downloads4.kaspersky-labs.com updates1.kaspersky-labs.com updates1.kaspersky-labs.com updates2.kaspersky-labs.com updates3.kaspersky-labs.com d-ru-2f.kaspersky-labs.com updates3.kaspersky-labs.com updates4.kaspersky-labs.com updates5.kaspersky-labs.com downloads-us1.kaspersky-labs.com downloads-us2.kaspersky-labs.com downloads-us3.kaspersky-labs.com engine.awaps.net f-secure.com ftp.avp.ch ftp.downloads2.kaspersky-labs.com ftp.f-secure.com ftp.kasperskylab.ru ftp.kaspersky.ru d-ru-1f.kaspersky-labs.com d-eu-1f.kaspersky-labs.com rads.mcafee.com d-eu-2f.kaspersky-labs.com d-us-1f.kaspersky-labs.com ftp.sophos.com ids.kaspersky-labs.com kaspersky.com kaspersky-labs.com liveupdate.symantec.com liveupdate.symantec.com liveupdate.symantec.com liveupdate.symantecliveupdate.com liveupdate.symantecliveupdate.com mast.mcafee.com mcafee.com my-etrust.com networkassociates.com phx.corporate-ir.net securityresponse.symantec.com service1.symantec.com sophos.com spd.atdmt.com symantec.com trendmicro.com update.symantec.com updates.symantec.com us.mcafee.com virustotal.com Back to the Top Detection F-Secure Anti-Virus detects this malware with the following updates: [FSAV_Database_Version] Version = 2006-05-24_04. Back to the Top Write-up: Alexey Podrezov, May 24, 2006 Technical Details: Alexey Podrezov, May 24, 2006 F-Secure Corporation