TSPY_SWOTTER.THFBOAJ

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes the initially executed copy of itself.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops a copy of itself in the following folders using different file names:

• %Program Files%\{random name 1}\{random name 2}.exe

(Note: %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.)

It drops the following files:

• %User Temp%\ns{Random}\System.dll
• %User Temp%\Proctodaeum.bin - detected as TSPY_SWOTTER.ENC (encrypted component)
• %User Temp%\unsocialism.dll - decrypts encrypted component, also detected as TSPY_SWOTTER.THFBOAJ

It adds the following processes:

• {Malware filepath}\{Malware filename}

It injects itself into the following processes running in the affected system's memory:

• {Malware filepath}\{Malware filename} (The process added by the malware)

It creates the following folders:

• %User Temp%\ns{Random}.tmp
• %Program Files%\{random name 1}
• %Application Data%\667MNQR6

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It injects threads into the following normal process(es):

• explorer.exe

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{Random3} = %Program Files%\{random name 1}\{random name 2}.exe

Information Theft

This Trojan gathers the following data:

• Clipboard content
• Keystrokes
• User's SID
• Operating system version
• Operating system architecture
• Username

It attempts to steal stored email credentials from the following:

• Thunderbird
• Microsoft Outlook

It attempts to get stored information such as user names, passwords, and hostnames from the following browsers:

• Firefox
• Opera
• Internet Explorer
• Google Chrome

Stolen Information

This Trojan saves the stolen information in the following file:

• %Application Data%\667MNQR6\667logcl.ini - clipboard content
• %Application Data%\667MNQR6\667log.ini - keystrokes
• %Application Data%\667MNQR6\667logrt.ini - Thunderbird passwords
• %Application Data%\667MNQR6\667logrg.ini - Google passwords
• %Application Data%\667MNQR6\667logrc.ini - Outlook passwords
• %Application Data%\667MNQR6\667logrv.ini - Windows Vault passwords
• %Application Data%\667MNQR6\667logro.ini - Opera passwords
• %Application Data%\667MNQR6\667logri.ini - Internet Explorer passwords
• %Application Data%\667MNQR6\667logrf.ini - Firefox passwords
• %Application Data%\667MNQR6\667logim.jpg - screenshot

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It sends the gathered information via HTTP POST to the following URL:

• http://www.{BLOCKED}ineandian.com/zz/
• http://www.{BLOCKED}angpanpan.com/zz/
• http://www.{BLOCKED}ten.com/zz/
• http://www.{BLOCKED}p.com/zz/
• http://www.{BLOCKED}rsfaits.com/zz/
• http://www.{BLOCKED}n.net/zz/
• http://www.{BLOCKED}werup.com/zz/
• http://www.{BLOCKED}ntedbookgarden.com/zz/
• http://www.{BLOCKED}apoder.com/zz/
• http://www.{BLOCKED}hes.com/zz/
• http://www.{BLOCKED}oto.com/zz/
• http://www.{BLOCKED}algroup.biz/zz/
• http://www.{BLOCKED}rlygrieve.com/zz/
• http://www.{BLOCKED}gallurproperty.com/zz/
• http://www.{BLOCKED}5.com/zz/
• http://www.{BLOCKED}h.com/zz/
• http://www.{BLOCKED}maury.net/zz/
• http://www.{BLOCKED}oenelmundo.com/zz/
• http://www.{BLOCKED}jobsuae.com/zz/
• http://www.{BLOCKED}ngtouzi.com/zz/
• http://www.{BLOCKED}or.com/zz/
• http://www.{BLOCKED}nglarnaca.com/zz/
• http://www.{BLOCKED}buhb.loan/zz/
• http://www.{BLOCKED}olabs.com/zz/
• http://www.{BLOCKED}stateagentinfolsom.com/zz/
• http://www.{BLOCKED}lijn.com/zz/
• http://www.{BLOCKED}grafica.com/zz/
• http://www.{BLOCKED}shikong.com/zz/
• http://www.{BLOCKED}o.com/zz/
• http://www.{BLOCKED}sepahyar.com/zz/
• http://www.{BLOCKED}oom.net/zz/
• http://www.{BLOCKED}y.com/zz/
• http://www.{BLOCKED}alky.site/zz/
• http://www.{BLOCKED}nytimeshare.info/zz/
• http://www.{BLOCKED}2bm3h1b060bftgdwp.com/zz/
• http://www.{BLOCKED}rteckcybbautboards.win/zz/

Other Details

This Trojan does the following:

• Can execute the following given the proper command from a remote malicious user:
  
  • Download and execute file
  • Update itself
  • Remove itself
  • Execute cmd commands
  • Clear browser cookies
  • Reboot system
  • Screenshot
  • Shutdown system

It deletes the initially executed copy of itself