Avira already detect it.
Seems to read out browser urls,usernames and passwords and send it to anywhere.
pw: infected
checked through: jotti
Detection is on it's way.
Thanks for the sample!