LogIT - Malware Gallery

Informations

Author	s13az3
Family	LogIT
Category	Information Stealer
Version	LogIT
Released Date	Aug 2004, 20 years, 3 months ago.
Language	C++

Additional Information

Server:
dropped files:
c:\WINNT\system32\logit.dll    Size: 3.584 bytes 
c:\WINNT\system32\logit.exe    Size: 17.920 bytes 

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "sysmon"
data: c:\winnt\system32\logit.exe
 
tested on Win2000

Author Information / Description

1. Features
===========

- Very lite server 18kb unpacked
- Logs ANY ASCII keyboard (simplified arabic, chinese, french, german)
- Logs Combination press keys e.g. ¬`¦!"£$%^&*(){}[] GfErSxB
- Solves common problem of erroneous repeated keys  e.g. "tttteeeesssstttt"
  in ms office would now be "test".
- Email log feature after certain size reached (and user is online)
- logger exe and dll written totally C++ and 100% compatible in all
  windows platforms of: 95OSR2/98/98SE/ME/NT/2k/XP/2003

2. Easy Start
=============

- Run "Builder.exe"
- Click "Builder" Tab in menu bar to left
- Choose your settings (or leave as default)
- Click "BUILD SERVER" button
- Choose filename and directory of your server file e.g. "test.exe"
- Send test.exe to the remote computer you want to log keystrokes on
- Execute test.exe ON THE REMOTE COMPUTER (NOT YOUR OWN)
- Keystrokes will now be logged to the "log filename" you specified in
  the settings before you built the server. ALL files are in the system
  directory. ie "Windows\System" or "Windows\System32"
- Download/Retrieve the log file and view the keystrokes at your leisure

s13az3