TSPY_GOLROTED.BBOCB

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy drops the following copies of itself into the affected system and executes them:

• %User Temp%\subfolder\filename.bat

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following files:

• %User Temp%\subfolder\filename.vbs -> script to run the copy of itself
• %Application Data%\pidloc.txt -> contains the full path and name of malware
• %Application Data%\pid.txt -> contains the process ID of the malware
• %User Temp%\holdermail.txt -> deleted afterwards
• %User Temp%\holderwb.txt -> deleted afterwards

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following processes:

• %Windows%\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "%User Temp%\holdermail.txt"
• %Windows%\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "%User Temp%\holderwb.txt"

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This Trojan Spy adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
Registry Key Name = %User Temp%\subfolder\filename.vbs

Other System Modifications

This Trojan Spy modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "1"

Information Theft

This Trojan Spy gathers the following data:

• Computer name
• Local Date and Time
• Installed Language
• .Net Version
• Operating System Platform
• Operating System Version
• Internal IP Address
• External IP Address
• Installed Antivirus
• Installed Firewall
• Key logs
• Clipboard logs
• Screenshot
• Account information from:
  • Bitcoin
  • Minecraft
  • Steam
  • Internet Download Manager
  • jDownloader
  • RuneScape

It attempts to steal stored email credentials from the following:

• Thunderbird
• Eudora
• Internet Account Manager
• MS Outlook
• Outlook Express
• Group Mail Free
• IncrediMail
• Windows Mail
• Windows Live Mail
• Yahoo! Mail
• Gmail
• Facebook

It attempts to get stored information such as user names, passwords, and hostnames from the following browsers:

• Internet Explorer
• Firefox
• Chrome
• Opera
• Safari
• SeaMonkey

Stolen Information

This Trojan Spy sends the data it gathers to the following email addresses via SMTP:

• bomba111@{BLOCKED}o.com

Other Details

This Trojan Spy connects to the following URL(s) to get the affected system's IP address:

• http://whatismyipaddress.com/

It does the following:

• It attempts to steal stored account credentials from the following Instant Messaging applications:
  • Google Talk
  • MSN Messenger