PayPal data stealing trojan and IcePack malware installer
PayRob.A is a Trojan designed to steal data from PayPal accounts. Like most Trojans, PayRob.A cannot spread by itself, but needs intervention from a malicious user to reach computers.
If the targeted user runs the file carrying PayRob.A, it gives itself hidden file attributes and modifies the Windows Registry to ensure it is run whenever the system is restarted.
The Trojan creates two files on the infected computer in the temporary Internet files folder and in C:\WINDOWS\MSAPPS\. If the latter folder is not found on the system, an error message is displayed.
It also copies a file called modeexpinovo.txt to the temporary Internet files folder. This text file stores all of the PayPal passwords that it finds on the affected system. This file can be accessed remotely by hackers from a certain Internet host.
