TSPY_CARBERP.E

 Analysis by: Michael Cabel

 PLATFORM:

Windows 2000, XP, Server 2003

 OVERALL RISK RATING:
 REPORTED INFECTION:
 SYSTEM IMPACT RATING:
 INFORMATION EXPOSURE:

  • Threat Type: Spyware

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes

  OVERVIEW


Trend Micro has flagged this spyware as noteworthy due to the increased potential for damage, propagation, or both, that it possesses. Specifically, this spyware sends sensitive data to a remote host.

To get a one-glance comprehensive view of the behavior of this Spyware, refer to the Threat Diagram shown below.

This spyware may be downloaded by other malware/grayware/spyware from remote sites. It may be unknowingly downloaded by a user while visiting malicious websites.

It hides files, processes, and/or registry entries.

It connects to certain URLs. It may do this to remotely inform a malicious user of its installation. It may also do this to download possibly malicious files onto the computer, which puts the computer at a greater risk of infection by other threats.

It deletes itself after execution.

  TECHNICAL DETAILS

File Size:

137,728 bytes

File Type:

PE

Memory Resident:

Yes

Initial Samples Received Date:

22 Oct 2010

Payload:

Downloads files, Hides files and processes

Arrival Details

This spyware may be downloaded by other malware/grayware/spyware from remote sites.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This spyware drops the following copies of itself into the affected system:

  • %User Startup%\chkntfs.exe

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

It is injected into the following processes running in memory:

  • svchost.exe

Rootkit Capabilities

This spyware hides files, processes, and/or registry entries.

Download Routine

This spyware connects to the following malicious URLs:

  • http://oollma.com/set/task.html

It accesses the following websites to download files:

  • http://oollma.com/cfg/miniav.plug
  • http://oollma.com/cfg/passw.plug
  • http://oollma.com/cfg/stopav.plug

Other Details

This spyware does the following:

  • Monitors the following wininet.DLL APIs to monitor the internet browsing activities in the affected system:
    • InternetReadFiles
    • InternetCloseHandle
    • HttpSendRequestA
    • HttpSendRequestW
    • InternetReadFileExA
    • InternetReadFileExW
    • HttpSendRequestExA
    • HttpSendRequestExW
  • Collects the following information and sends it to http://oollma.com/get/gra.html via HTTP Post:
    • Email
    • POP3 User Name
    • POP3 Password
    • POP3 Server
    • SMTP User Name
    • SMTP Server
  • Searches for all running processes and sends the list to the following remote site via HTTP Post:
    • http://oollma.com/set/first.html

It deletes itself after execution.

  SOLUTION

Minimum Scan Engine:

8.900

FIRST VSAPI PATTERN FILE:

7.560.01

FIRST VSAPI PATTERN DATE:

22 Oct 2010

VSAPI OPR PATTERN File:

7.565.00

VSAPI OPR PATTERN Date:

23 Oct 2010

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Restart in Safe Mode

[ Learn More ]

Step 3

Search and delete this file

[ Learn More ]
There may be some component files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden files and folders in the search result.  %User Startup%\chkntfs.exe

Step 4

Scan your computer with your Trend Micro product to delete files detected as TSPY_CARBERP.E. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.