TSPY_BANKR.EA

This spyware may arrive in a system as dd800s.exe. It searches and installs a component file. It does not continue with its routine if it does not exists.

This spyware may be downloaded by other malware/grayware/spyware from remote sites. It may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

Arrival Details

This spyware may be downloaded by other malware/grayware/spyware from remote sites.

It may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
dd80v3 = "{malware EXE path and file name}"

It adds the following registry keys to install itself as a Browser Helper Object (BHO):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{A05D3A6A-D401-4402-983E-A54BA8BC2EE2}

Other System Modifications

This spyware adds the following registry keys:

HKEY_CURRENT_USER\Software\dd80pp

HKEY_CLASSES_ROOT\dd80.P

HKEY_CLASSES_ROOT\dd80.P\Clsid

HKEY_CLASSES_ROOT\CLSID\{A05D3A6A-D401-4402-983E-A54BA8BC2EE2}

HKEY_CLASSES_ROOT\CLSID\{A05D3A6A-D401-4402-983E-A54BA8BC2EE2}\
InprocServer32

HKEY_CLASSES_ROOT\CLSID\{A05D3A6A-D401-4402-983E-A54BA8BC2EE2}\
ProgID

It adds the following registry entries:

HKEY_CLASSES_ROOT\dd80.P
(default) = "O"

HKEY_CLASSES_ROOT\dd80.P\Clsid
(default) = "{A05D3A6A-D401-4402-983E-A54BA8BC2EE2}"

HKEY_CLASSES_ROOT\CLSID\{A05D3A6A-D401-4402-983E-A54BA8BC2EE2}
(default) = "O"

HKEY_CLASSES_ROOT\CLSID\{A05D3A6A-D401-4402-983E-A54BA8BC2EE2}\
InprocServer32
(default) = "{malware DLL path and file name}"

HKEY_CLASSES_ROOT\CLSID\{A05D3A6A-D401-4402-983E-A54BA8BC2EE2}\
InprocServer32
ThreadingModel = "Apartment"

HKEY_CLASSES_ROOT\CLSID\{A05D3A6A-D401-4402-983E-A54BA8BC2EE2}\
ProgID
(default) = "dd80.P"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{A05D3A6A-D401-4402-983E-A54BA8BC2EE2}
NoExplorer = "1"

Download Routine

This spyware downloads an updated copy of itself from the following website(s):

• http://up.{BLOCKED}80.kr/dd80s.exe

Information Theft

This spyware accesses the following site to download its configuration file:

• http://www.{BLOCKED}80.kr/update.php

Stolen Information

This spyware sends the gathered information via HTTP POST to the following URL:

• http://up.{BLOCKED}80.kr//sql.php

NOTES:

It may arrive in a system as dd800s.exe.

It searches and installs the following component file. It does not continue with its routine if it does not exists.

• {malware path}\dd80.dll

Configuration file:

• http://www.{BLOCKED}80.kr/update.php

It saves the downloaded configuration file as the following:

• {malware path}\dd80_conifg.ini

The configuration file contains a URL where the malware can download other files, an update of itself, file name to use, and malware version.

If an update of itself is available, it renames itself to old_dd800s.exe, the component DLL as old_dd80.dll, then saves the newly downloaded files dd800s.exe and dd80.dll respectively.

It monitors the browsing activies of the affected system to steal information related to the following financial Websites:

• https://{BLOCKED}me.{BLOCKED}ren24.com/servlet/
• https://{BLOCKED}ure.{BLOCKED}uya.com/
• http://www.{BLOCKED}itbank.co.kr/
• http://www.{BLOCKED}en24.com/

It attempts to delete the following registry entries, which may be related to previous versions of itself:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
dd80vkin
dd80vk