F-Secure Trojan Information Pages : Small.la
[ Summary ] | [ Detailed Description ] | [ Detection ]
Name: Small.la
Alias: Backdoor.Win32.Small.la
Type: Backdoor, Trojan, Rootkit
Category: Trojan
Platform: Win32
Summary
Small.la is a spying trojan that targets several online poker games. It was distributed from a website checkraised.com using a trojaned Rakeback calculator application (RBCalc.exe). The trojan hides itself using rootkit techniques.
Detailed Description
System installation
When the trojan application RBCalc.exe is executed, it silently drops the following 4 files to windows system directory:
utlsrv.exe
comclg32.dll
d3dclsrv.dll
ndsdavsrv.sys
Then the dropper executes file utlsrv.exe, which is the trojan main file.
When the main file is run, it installs the following registry lauchpoint:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Comclg32" = "%system%\utlsrv.exe /Comclg32.dll"
After that, it monitors the running processes and injects the spying component comclg32.dll to following list of tasks:
PartyGaming.exe
mppoker.exe
poker.exe
gameclient.exe
ultimatebet.exe
absolutepoker.exe
mainclient.exe
pokerstars.exe
pokerstarsupdate.exe
partypoker.exe
fulltiltpoker.exe
pokernow.exe
multipoker.exe
empirepoker.exe
eurobetpoker.exe
The trojan main component also checks if the following processes are running on system:
blackice.exe
blackd.exe
outpost.exe
umxagent.exe
umxcfg.exe
umxfwhlp.exe
umxlu.exe
umxtray.exe
umxpol.exe
zone alarm security
If any of the above processes exist, the trojan quits execution.
Here's a screenshot of RBCalc.exe main screen:
Rootkit functionality
The trojan main file installs and loads the driver ndsdavsrv.sys and uses it to hide its process and the registry launchpoint.
Backdoor
When the spying component comclg32.dll is initialized, it starts a keylogger and connects to a remote server. The server can instruct the backdoor to do any of the following tasks:
download execute files
upload files
shutdown trojan
send application screenshots
The backdoor also sends out sensitive information to remote server, including keylogger database, computer name, and the username and password of the following onlike poker applications:
CEPoker
partypoker
pokernow
MultiPoker
Empirepoker
Detection
F-Secure Anti-Virus detects this malware with the following updates:
[FSAV_Database_Version]
Version = 2006-05-08_01.
Write-up: Jarkko Turkulainen, May 16, 2006
Technical Details: Jarkko Turkulainen, May 16, 2006
Description Updated: Jarkko Turkulainen, May 16, 2006
F-Secure Corporation
