Analysis by: Mark Joseph Manahan
ALIASES:

PWS:Win32/Milena.B (Microsoft), Infostealer (Symantec), PWS-BW (McAfee)

 PLATFORM:

Windows 2000, Server 2003, Windows 98

 OVERALL RISK RATING:
 REPORTED INFECTION:
 SYSTEM IMPACT RATING:
 INFORMATION EXPOSURE:

  • Threat Type: Spyware

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This spyware arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

File Size: 195,701 bytes
File Type: EXE
Initial Samples Received Date: 24 May 2009

Arrival Details

This spyware arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion
HDD_API = "{malware path and filename}"