Overall risk rating:

Reported detections:

System  impact:

Information exposure:

Description:

This spyware arrives as a self-extracting WinRAR executable file.

It drops certain .DLL component files to the Layered Service Provider (LSP) chain to ensure its automatic execution every time the affected user opens an Internet Explorer browser.

Upon execution, this spyware intercepts and logs network traffic before redirecting the target user to the originally desired Web site, thus allowing the spyware to monitor the affected user's Internet browsing activities and steal critical user information such as user names and passwords.

This spyware saves its gathered information in a certain file and either sends the said file to a remote malicious user using its own Simple Mail Transfer Protocol (SMTP) engine or uploads it to a server URL.

For additional information about this threat, see:
Solution
Technical Details