When a keygen is more than a keygen |
| Tuesday, 02 February 2010 | |||||
Page 1 of 3
Today I ran into a rather interesting keygen for a Corel application. A part from being infected with a passwordstealer, this keygen actually might work perfectly. Unfortunately I could not install Paintshop Photo Pro X3 as the installer kept complaining that it could not stop the WIA service it started a few seconds before. While you're peacefully cracking PaintShop Photo Pro X3, the keygen is collecting and sending out usernames and passwords from different applications and games (see list below). The program also disables the UAC on Vista
When you run the installer, it starts by dropping another smaller executable also called keygen.exe in your temp folders.
First strange behavior, the keygen wants to start the WMI service.
In the background the keygen is looking for usernames and passwords from the following applications and games:
It also checks the following registry key to find out if the victim uses Dynamic DNS Update Clients from no-ip.com: HKLM\SOFTWARE\Vitalwerks\DUC The keygen also has a couple of anti sandbox tricks which makes the analysis harder.
|
|||||
Life Support
