TSPY_SPYEYE.BIN

This spyware may be downloaded by other malware/grayware/spyware from remote sites. It may be unknowingly downloaded by a user while visiting malicious websites.

It connects to a website to send and receive information.

It also has rootkit capabilities, which enables it to hide its processes and files from the user.

It modifies the Internet Explorer Zone Settings.

It attempts to steal sensitive online banking information, such as user names and passwords. This routine risks the exposure of the user's account information, which may then lead to the unauthorized use of the stolen data.

Arrival Details

This spyware may be downloaded by other malware/grayware/spyware from remote sites.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This spyware drops the following copies of itself into the affected system:

• %System Root%Recycle.Bin\B6232F3A1D5.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It drops the following non-malicious file:

• %System Root%Recycle.Bin\2FC03553D109167 - configuration file

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It creates the following folders:

• %System Root%Recycle.Bin

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
4Y3Y0C3AXF7XXHYWYOWMYC = "%System Root%Recycle.Bin\B6232F3A1D5.exe /q"

Other System Modifications

This spyware adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\PhishingFilter
EnabledV8 = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\PhishingFilter
ShownServiceDownBalloon = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Recovery
ClearBrowsingHistoryOnExit = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
WarnOnPostRedirect = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
WarnOnIntranet = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
GlobalUserOffline = "0"

Backdoor Routine

This spyware connects to the following websites to send and receive information:

• www.{BLOCKED}xxs400.biz

Rootkit Capabilities

This spyware also has rootkit capabilities, which enables it to hide its processes and files from the user.

Web Browser Home Page and Search Page Modification

This spyware modifies the Internet Explorer Zone Settings.

Information Theft

This spyware attempts to steal sensitive online banking information, such as user names and passwords. This routine risks the exposure of the user's account information, which may then lead to the unauthorized use of the stolen data.

NOTES:

It injects a remote thread to all running processes except for the following:

• System
• smss.exe
• csrss.exe
• services.exe
• Recycle.Bin.exe

It sends the following system information to its C&C server:

• Account type
• Internet Explorer (IE) version
• Language ID
• Local time
• OS Information
• Tick time
• Timezone
• Volume information

It reports the following BOT information to its C&C server:

• Bot GUID
• Bot hash
• Bot Status (online/offline)
• Bot version
• Function data
• Hooked function
• Plug-in
• Process name
• Status of executed commands

It hooks the following APIs to aid in its malicious routines:

• advapi32.dll:
  CryptEncrypt
• crypt32.dll:
  PFXImportCertStore
• user32.dll:
  TranslateMessage
• wininet.dll:
  
  HttpAddRequestHeadersA
  HttpOpenRequestA
  HttpQueryInfoA
  HttpSendRequestA
  HttpSendRequestW
  InternetCloseHandle
  InternetQueryDataAvailable
  InternetQueryOptionA
  InternetReadFile
  InternetReadFileExA
  InternetWriteFile
• ws2_32.dll:
  send
  
• ntdll.dll:
  
  NtClose
  NtEnumerateValueKey
  NtQueryDirectoryFile
  NtResumeThread
  NtSetInformationFile
  NtVdmControl

It is capable of performing the following routines:

• Update configuration file
• Update itself
• Steal FTP accounts
• Steal POP3 accounts
• Steal certificates
• Capture screenshots
• Perform forms grabbing and webinjects on the following browsers: Internet Explorer, Firefox, Opera, Chrome
• Harvest email addresses
• Open a reverse FTP connection
• Open a reverse connections through a proxy server
• Open a remote desktop connection