Win32/Spy.Lohinar [Threat Name] go to Threat

Win32/Spy.Lohinar [Threat Variant Name]

Category trojan
Size 39843 B
Detection created Feb 03, 2005
Detection database version 1991
Aliases Trojan-Spy.Win32.Lohinar (Kaspersky)
  Trojan.PWS.Lohin.50 (Dr.Web)
  Troj/Lohinar (Sophos)
  TrojanSpy:Win32/Lohinar (Microsoft)
Short description

Win32/Spy.Lohinar is a trojan that steals sensitive information. The trojan attempts to send gathered information to a remote machine. The file is run-time compressed using ZIP SFX .

Installation

When executed, the trojan creates the following files:

  • %system%\­browser.exe
  • %currentfolder%\­browser.exe
  • %currentfolder%\­browser.dll

The trojan executes the following files:

  • %currentfolder%\­browser.exe

In order to be executed on every system start, the trojan sets the following Registry entry:

  • [HKEY_LOCAL_MACHINE\­SOFTWARE\­Microsoft\­Windows\­CurrentVersion\­Run]
    • "browser" = "%system%\­browser.exe"
Information stealing

The trojan gathers information related to the following services:

  • WebMoney

The trojan is able to log keystrokes.


The trojan collects the following information:

  • data from the clipboard
  • user name
  • computer name
  • operating system version

The trojan contains a list of (1) addresses. The trojan sends the information via e-mail.

Other information

The trojan opens the following URLs in Internet Explorer :

  • www.porno.ru

Please enable Javascript to ensure correct displaying of this content and refresh this page.