TSPY_URSNIF.THOIBEAN

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain websites to send and receive information.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy drops the following copies of itself into the affected system and executes them:

• %Application Data%\{string1}{string2}\{string1}{string2}.exe
  • {string1} = first four letters of a dll file under %System% directory
  • {string2} = last four letters of a dll file under %System% directory

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It drops and executes the following files:

• %User Temp%\{random folder name}\{random filename}.bat = used to delete originally executed copy of itself. Deleted afterwards

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

It injects codes into the following process(es):

• explorer.exe

Autostart Technique

This Trojan Spy adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{string1}{string2} = %Application Data%\{string1}{string2}\{string1}{string2}.exe

Other System Modifications

This Trojan Spy adds the following registry keys:

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Microsoft\{GUID}

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Microsoft\{GUID}\
Vars

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Microsoft\{GUID}\
Files

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Microsoft\{GUID}\
Config

It adds the following registry entries:

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Microsoft\{GUID}
{UID} = "{hex value}"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Microsoft\{GUID}
Main = "{hex value}"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Microsoft\{GUID}
Block = "{hex value}"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Microsoft\{GUID}
Temp = "{hex value}"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Microsoft\{GUID}
Client = "{hex value}"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Microsoft\{GUID}
Ini = "{hex value}"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Microsoft\{GUID}
Keys = "{hex value}"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Microsoft\{GUID}
Install = "{hex value}"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Microsoft\{GUID}
LastTask = "{hex value}"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Microsoft\{GUID}
LastConfig = "{hex value}"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Microsoft\{GUID}
CrHook = "{hex value}"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Microsoft\{GUID}
OpHook = "{hex value}"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Microsoft\{GUID}
Exec = "{hex value}"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Microsoft\{GUID}
NetCfg = "{hex value}"

Dropping Routine

This Trojan Spy drops the following files:

• %User Temp%\{random filename}.bin
• %User Temp%\{random filename}.bin1

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

Information Theft

This Trojan Spy gathers the following data:

• System information
• Keyboard logs
• Browser cookies
• Email credentials
• Clipboard logs
• Installed software
• List of computers and devices on the network
• IP address
• Currently running processes
• Installed drivers

Other Details

This Trojan Spy connects to the following website to send and receive information:

• https://{BLOCKED}heck.com/images/{random path}.{jpeg | gif | bmp}
• https://{BLOCKED}la.com/images/{random path}.{jpeg | gif | bmp}

It does the following:

• Saves stolen information in a file and then uploads it
• Monitors Internet browsing activities
• Hooks APIs of target processes
• Disables SPDY protocol
• Executes the following commands:
  • cmd /C "systeminfo.exe > %User Temp%\{random filename}.bin1"
  • cmd /C "net view >> %User Temp%\{random filename}.bin1"
  • cmd /C "nslookup 127.0.0.1 >> %User Temp%\{random filename}.bin1"
  • cmd /C "tasklist.exe /SVC >> %User Temp%\{random filename}.bin1"
  • cmd /C "driverquery.exe >> %User Temp%\{random filename}.bin1"
  • cmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> %User Temp%\{random filename}.bin1"
  • cmd /U /C "type %User Temp%\{random filename}.bin1 > %User Temp%\{random filename}.bin & del %User Temp%\{random filename}.bin1"
  • makecab.exe /F "%User Temp%\{random filename}.bin

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)