TSPY_DRIDEX.VVQI

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be downloaded by other malware/grayware/spyware from remote sites.

It connects to certain websites to send and receive information. It deletes itself after execution.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be downloaded by other malware/grayware/spyware from remote sites.

Installation

This spyware drops the following copies of itself into the affected system and executes them:

• %AppDataLocal%\edg{number}.exe
• %AppDataLocal%\edg{number}.tmp - deleted afterwards

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following file(s)/component(s):

• %Application Data%\LocalLow\{random file name 1}.sdb --> this file stores customized database files for compatibility fix which is silently installed by the malware
• %Application Data%\LocalLow\{random file name 1}.bat -->this batch file is responsible for deleting created .SDB file, other .SDB files installed in the system, and itself

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It injects codes into the following process(es):

• explorer.exe

Other System Modifications

This spyware adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
CLSID\{GUID}\ShellFolder
{random} = "{encrypted}"

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Custom\iscsicli.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
InstalledSDB\{GUID}.sdb

Information Theft

This spyware gathers the following data:

• username
• computer name
• installation date

Other Details

This spyware connects to the following website to send and receive information:

• http://{BLOCKED}ZcywPJi3okzSm.biz/UzSt7Bq$Goss.oss9n/VNCsyD4/h/

It does the following:

• httpshots - where malware captures screenshots when browser navigates to a specific website address
• Form grabbing
• clickshots - where malware captures screenshots when user clicks on a specific link
• Site injections

It deletes itself after execution.

NOTES:

This spyware monitors the following browsers:

• firefox.exe
• chrome.exe
• iexplore.exe

It may load any of the following modules:

• vnc_x32
• socks_x32
• bot_x32<