|
GOPtrojan Password Hijacker Information
| Name: |
GOPtrojan |
| Category: |
Password Hijacker |
| Advice: |
Remove |
| Risk: |
High Risk
High risk threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction. May open up communication ports, use polymorphic tactics, stealth installations, and/or anti-spy counter measures. May use a security flaw in the operating system to gain access to your computer. |
| Description:
|
This program belongs to the family of password stealing Trojans. This Trojan seems to be written in Chinese and is designed to steal OICQ (a Chinese clone of ICQ?) passwords.
When run, the Trojan installs itself to the system. While installing, the Trojan copies itself to Windows, the Windows system or TEMP directory, and registers itself in the system registry auto-run section. The installed Trojan file name and the target directory are optional. They are stored in encrypted form in the Trojan file at the file end. To steal OICQ data, the Trojan also drops an additional DLL file (hooker) with an optional name. A hacker may configure optional data before sending the Trojan to a victim's machine, or before placing it on a Web site.
|
| Signatures:
|
process: editgop.exe: MD5 Hash: 2279abb5c666bdd5b9d...
process: gop.exe: MD5 Hash: 87bb21d0139037d7c4c...
process: editgop.exe: MD5 Hash: 9c80d872feabac34423...
process: gop.exe: MD5 Hash: 2c7f98fa357e1bf8de8...
process: gopsplit.exe: MD5 Hash: c1c6abf6928cc0f2114...
process: sysexhook.exe: MD5 Hash: ...
process: sysexhook.exe: MD5 Hash: .. |
| Type: |
Password Hijacker - A Trojan software is any software on a user's computer that the user is not aware or intentionally installed. Most Trojan software is designed to perform some sort of actions that could jeopardize the user's security or privacy. |
Top Password Hijacker Visited Pages:
MSN Hotmail Password Stealer - Alias: PWS-Kcom.gen, Trojan.PSW.Akcom.g - 1714 visits
Hotmail Hacker X-Edition - 1139 visits
Y! Jacked v1.3 - 623 visits
Magic PS Yahoo! Messenger - Alias: Trojan.PSW.Sagic, Trojan.PSW.Sagic.11 - 593 visits
Fake login Yahoo - 357 visits
Passware Kit - 308 visits
Cache Password - 214 visits
PassView - 93 visits
Ace Password Sniffer 1.1 - 87 visits
Matiteman Mail Pass Stealer - Alias: Trojan.PSW.Mtmpas.b - 85 visits
Random Password Hijacker Pages:
Easyget - Alias: Trojan.Win32.Easyget.30
Susanin
Proactive Windows Security Explorer
AIM Robber - Alias: Backdoor.GoAway
Password Mailer Pro - Alias: PWS-Kruto
Cahyna Trojan
Y! Jacked v1.3
New Moscow Mail Trojan - Alias: Trojan.PSW.Platan.5.d, Trojan.PSW.Nemotron for Configurator.exe
GOPtrojan - Alias: GOPworm
Naebi 2.31
|
