TSPY_QBOT.L

This spyware belongs to a multi-component malware.

It steals sensitive system information and sends the information to its C&C server.

It downloads its component files from certain websites, where it also sends its stolen information.

It terminates certain processes if found running in the affected system's memory.

This spyware may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

It also has rootkit capabilities, which enables it to hide its processes and files from the user.

It accesses websites to download files. This action allows this malware to possibly add other malware on the affected computer. It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system. It saves downloaded files into the said created folder.

It gathers certain information on the affected computer. It sends the information it gathers to remote sites.

Arrival Details

This spyware may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This spyware drops the following copies of itself into the affected system:

• %System Root%\Documents and Settings\All Users\Application Data\Microsoft\qgewcjtlz\q1.{random number}

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It creates the following folders:

• %System Root%\Documents and Settings\All Users\Application Data\Microsoft\qgewcjtlz

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Rootkit Capabilities

This spyware also has rootkit capabilities, which enables it to hide its processes and files from the user.

Process Termination

This spyware terminates the following processes if found running in the affected system's memory:

• ccApp.exe
• cmd.exe
• ctfmon.exe
• dbgview.exe
• far.exe
• mirc.exe
• mmc.exe
• msdev.exe
• nc.exe
• ollydbg.exe
• outlook.exe
• photoed
• R&Q.exe
• skype

Download Routine

This spyware accesses websites to download the following files:

• aaveimi - detected as TROJ_BAMITAL.AQ
• qgewcjtlz.exe - detected as TROJ_BAMITAL.AQ
• qgewcjtl.dll - contains encrypted data
• qgewcjtlz.dl - detected as TSPY_QBOT.N
• qgewcjtlzyw.dll - detected as TSPY_QBOT.N
• qgewcjtlzxn.exe - detected as TROJ_BAMITAL.AQ
• xujqa2y - contains encrypted data

It connects to the following URL(s) to download its component file(s):

• http://{BLOCKED}rver.com.ua/cgi-bin/ss.pl
• http://{BLOCKED}rver.com.ua/cgi-bin/exhandler4.pl
• http://{BLOCKED}owthewhistle.com/cgi-bin/clientinfo3.pl
• http://{BLOCKED}6.in/cgi-bin/jl/jloader.pl
• http://{BLOCKED}2.cn/cgi-bin/jl/jloader.pl

It saves the files it downloads using the following names:

• alias__qbotnti.exe
• alias__qbotinj.exe
• alias__qbot.cb
• _qbotinj.exe
• _qbotnti.exe
• q3.dll
• _qbot.dll
• alias__qbot.dll
• crontab.cb
• /u/updates98.cb
• alias_updates.cb
• /u/updates.cb
• updates1.cb
• updates*_new.cb

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

It saves downloaded files into the said created folder.

Information Theft

This spyware monitors the Internet Explorer (IE) activities of the affected system, specifically the address bar or title bar. It recreates a legitimate website with a spoofed login page if a user visits banking sites with the following strings in the address bar or title bar:

• singlepoint.usbank.com
• netconnect.bokf.com
• business-eb.ibanking-services.com
• cashproonline.bankofamerica.com
• /cashplus/
• ebanking-services.com
• /cashman/
• web-cashplus.com
• treas-mgt.frostbank.com
• business-eb.ibanking-services.com
• treasury.pncbank.com
• access.jpmorgan.com
• ktt.key.com
• onlineserv/CM
• premierview.membersunited.org
• directline4biz.com
• onb.webcashmgmt.com
• tmconnectweb
• moneymanagergps.com
• ibc.klikbca.com
• directpay.wellsfargo.com
• express.53.com
• itreasury.regions.com
• itreasurypr.regions.com
• cpw-achweb.bankofamerica.com
• businessaccess.citibank.citigroup.com
• businessonline.huntington.com

It gathers the following information on the affected computer:

• ext_ip
• dnsname
• hostname
• country
• state
• city
• user
• domain
• is_admin
• os
• time
• qbot_version

It sends the information it gathers to remote sites.

Other Details

This spyware does the following:

• It may be executed with the /f argument.
• It may send the gathered information to the above-mentioned websites, where it downloads other component files.
• It also sends the sensitive information it gathers to its C&C server.
• It is capable of connecting to a certain IRC server using a certain port and joins a channel where it receives commands from a malicious user.