PE_LICAT.B-O

This malware is a new LICAT variant that uses a different key for its domain generation algorithm.

To get a one-glance comprehensive view of the behavior of this File infector, refer to the Threat Diagram shown below.

It infects file associated with running processes. Infected files are detected as PE_LICAT.B.

This file infector may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

It may be injected into processes running in memory.

It infects by inserting its code to unused space in host files.

It opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

It modifies the Internet Explorer Zone Settings.

It attempts to steal sensitive online banking information, such as user names and passwords. This routine risks the exposure of the user's account information, which may then lead to the unauthorized use of the stolen data. It attempts to steal information, such as user names and passwords, used when logging into certain banking or finance-related websites.

Arrival Details

This file infector may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This file infector drops the following files:

• %Application Data%\{random1}\{random}.exe - copy of itself
• %Application Data%\{random2}\{random}.{3 random alpha character extension name} - encrypted data

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It creates the following folders:

• %Application Data%\{random1}
• %Application Data%\{random2}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It is injected into the following processes running in memory:

• ctfmon.exe
• dwm.exe
• explorer.exe
• rdpclip.exe
• taskeng.exe
• taskhost.exe
• wscntfy.exe

It may be injected into processes running in memory.

Autostart Technique

This file infector adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{GUID} = %Application Data%\{random}\{random name}.EXE

Other System Modifications

This file infector adds the following registry keys as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
{random}

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%WINDOWS%\EXPLORER.EXE = %WINDOWS%\EXPLORER.EXE:*:Enabled:Windows Explorer

File Infection

This file infector infects the following file types:

• EXE

It infects by inserting its code to unused space in host files.

Backdoor Routine

This file infector opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

Web Browser Home Page and Search Page Modification

This file infector modifies the Internet Explorer Zone Settings.

Information Theft

This file infector monitors the Internet Explorer (IE) activities of the affected system, specifically the address bar or title bar. It recreates a legitimate website with a spoofed login page if a user visits banking sites with the following strings in the address bar or title bar:

• https://*.ebanking-services.com/*/signin.aspx
• https://express.53.com/express/logon.jsp
• ttps://wellsoffice.wellsfargo.com/ceoportal/signon/index.jsp
• https://www.accountcentralonline.com
• https://secure.americanexpress.com
• https://www.bankofamerica.com
• https://chaseonline.chase.com
• https://www.accountonline.com
• https://www.cajalaboral.com
• https://customer.eu.clickandbuy.com
• https://www.discovercard.com/cardmembersvcs/personalprofile/pp/GetInitialInfo
• https://www.ezcardinfo.com
• https://signin.fiabusinesscard.com
• https://www.accountcentralonline.com
• https://www.ibsnetaccess.com
• https://www.macys.com
• ttps://www.moneybookers.com
• https://www.myaccountaccess.com
• https://www.partnercardservices.com
• https://www.paypal.com
• ttps://www.pnccardservicesonline.com
• https://client.schwab.com
• https://www.suntrust.com
• https://content.usaa.com
• cey-ebanking.com
• treasury.pncbank.com/portal/esec/login.ht
• https://www.us.hsbc.com/1/2/
• https://bnycash.bankofny.com/
• ebanking-services.com
• https://www.usaa.com/inet
• https://www.saferpay.com/vt/pay.asp
• https://express.53.com/express/logon
• https://www.business.hsbc.co.uk/1/2/
• https://www.paypal.com/gates/google
• https://direct.53.com/logon53Direct.jsp
• https://www.gotomycard.com/accounts.asp
• https://www.saferpay.com/gates/google
• https://ibank.barclays.co.uk/olb/u/Login
• https://www.moneybookers.com/app/profile.pl
• Zhttps://www.myaccountaccess.com/onlineCard/
• https://www.ezcardinfo.com/AcctSummary.aspx
• https://www.moneybookers.com/gates/google
• https://chsec.wellsfargo.com/login/login.fcc
• https://securentrycorp.amegybank.com
• https://ssl.selectpayment.com/
• https://chaseonline.chase.com/MyAccounts.aspx
• https://www.paypal.com/C/cgi-bin/webscr
• https://sitekey.bankofamerica.com/sas/maint.do
• https://online.citibank.com/US/</portal/Home.do
• https://www.hsbccreditcard.com/ecare/viewaccount
• https://www.suntrust.com/portal/server.pt?mode=2
• https://www.mycardstatement.com/AcctSummary.aspx
• https://customer.eu.clickandbuy.com/gates/google
• https://onlinebankingC.wachovia.com/myAccounts.aspx
• https://www.accountcentralonline.com/cmuser/myacct/
• https://www.discovercard.com/cardmembersvcs/achome/
• https://online.wellsfargo.com/das/cgi-bin/session.cgi
• https://www.nordstromcard.com/fdr_nr.service?TRANTYPE
• https://www.statementlook.com/fdr_ge.service?TRANTYPE
• https://wwwC.usbank.com/internetBanking/RequestRouter
• https://www.partnercardservices.com/ecare/viewaccount
• https://client.schwab.com/accounts/summary/summary.aspx
• https://www.paypal.com/C/cgi-bin/webscr?cmd=_login-done
• https://www.hsbccreditcard.com/ecare/control/generic.js
• https://singlepoint.usbank.com/cs70_banking/logon/sbuser
• https://www.paypal.com/de/cgi-bin/webscr?cmd=_login-done
• https://www.fiabusinesscard.com/cgi-bin/ias/
• https://www.linksimprese.sanpaoloimi.com/pmiweb/LoginServlet
• https://www.partnercardservices.com/ecare/control/generic.js
• https://wellsoffice.wellsfargo.com/ceoportal/signon/index.jsp
• https://www.barclaycardus.com/app/ccsite/action/switchAccount
• https://businessaccess.citibank.citigroup.com/cbusol/signon.do
• https://banking.commercebank.com/CBI/Accounts/CBI/Summary.aspxU
• https://onlineeastC.bankofamerica.com/cgi-bin/ias/
• https://www.pnccardservicesonline.com/pages/AccountSummary.aspx
• https://authmaster.nationalcity.com/tmgmt/
• https://treas-mgt.frostbank.com/rdp/cgi-bin/
• https://sitekey.bankofamerica.com/sas/sas-docs/js/commonscript.js
• https://cm.netteller.com/login2008/Authentication/Views/Login.aspx
• https://www.myaccountaccess.com/onlineCard/postLogin.do?phase=start
• https://access.jpmorgan.com/appmanager/jpmalogonportal/jpmalogonhome
• ttps://businessonline.tdbank.com/corporatebankingweb/core/login.aspx
• https://www.comerica.com/
• https://wwwB.comerica.com/
• https://businessonline.huntington.com/BOLHome/BusinessOnlineLogin.aspx
• https://www.ibsnetaccess.com/NASApp/NetAccess/RegisteredAccountsDisplay
• https://businessaccess.citibank.citigroup.com/cbusol/sign
• https://www.discovercard.com/cardmembersvcs/personalprofile/pp/GetInitialInfo
• https://customer.eu.clickandbuy.com/surfer/spring/accounthome-flow
• https://www.ibsnetaccess.com/NASApp/NetAccess/updateQandA.action?target=updtQA
• https://www.paypal.com/C/cgi-bin/webscr?cmd=_profile-credit-card-new-clickthru
• https://onlineeastC.bankofamerica.com/cgi-bin/ias/
• https://online.americanexpress.com/myca/acctsumm/us/action?request_type=authreg_acctAccountSummary
• https://www.hsbccreditcard.com/ecare/customerservice/updatepersonalinfo?&locale=en_US&brand=HB_090_750
• https://www.partnercardservices.com/ecare/customerservice/updatepersonalinfo?&locale=en_US&brand=RZ_500_501

It attempts to steal sensitive online banking information, such as user names and passwords. This routine risks the exposure of the user's account information, which may then lead to the unauthorized use of the stolen data.

It accesses the following site to download its configuration file:

• http://{BLOCKED}pzrjrge.org/news/?s={random number}

It attempts to steal information from the following banks and/or other financial institutions:

• Fifth Third Direct
• Wellsfargo
• HSBC
• American Express
• Bank of America
• Chase
• Citi
• Caja Laboral
• ClickandBuy
• Discover Card
• eZCardInfo
• Card Information Online
• FIA Card Services
• Macy's
• Moneybookers
• Online Account Access
• Partner Card Services
• Paypal
• PNC Card Services
• Charles Schwab
• Suntrust
• USAA
• Mountain National Bank
• PNC Bank
• Business Internet Banking
• Saferpay
• GoToMyCard
• Barclays
• Amegy Bank
• Profit Stars
• Wachovia
• Nordstrom Credit Services
• Statementlook
• US Bank
• Commerce Bank
• Frost Bank
• National City
• Net Teller
• JP Morgan
• TD Bank
• Comerica
• Huntington National Bank

Stolen Information

This file infector sends the gathered information via HTTP POST to the following URL:

• http://{BLOCKED}pzrjrge.org

Other Details

This file infector does the following:

• It infects files associated with running processes.
• Infected files are detected as PE_LICAT.B.