TSPY_DYRE.NHV

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following files:

• %System%\config\systemprofile\Application Data\bq5uzce1f3.dll (for Windows XP and lower)
• %AppDataLocal%\bq5uzce1f3.dll (for Windows Vista and higher)

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following copies of itself into the affected system:

• %Windows%\{random filename}.exe (for Windows XP and lower)
• %AppDataLocal%\{random filename}.exe (for Vista and higher)

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This spyware registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\ge
ImagePath = "%Windows%\{random Filename}.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\ge
DisplayName = "Google Update"

It adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
GoogleUpdate = "%AppDataLocal%\{random filename}.exe"

It registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\ge (for Windows XP and lower)

Other Details

This spyware connects to the following possibly malicious URL:

• {BLOCKED}.{BLOCKED}.81.96:4443
• {BLOCKED}.{BLOCKED}.190.84:443
• {BLOCKED}.{BLOCKED}.191.213:443
• {BLOCKED}.{BLOCKED}.153.216:443
• {BLOCKED}.{BLOCKED}.201.9:443
• {BLOCKED}.{BLOCKED}.219.35:443
• {BLOCKED}.{BLOCKED}.152.131:443
• {BLOCKED}.{BLOCKED}.23.130:443
• {BLOCKED}.{BLOCKED}.235.48:443
• {BLOCKED}.{BLOCKED}.170.118:443
• {BLOCKED}.{BLOCKED}.97.141:443
• {BLOCKED}.{BLOCKED}.154.243:443
• {BLOCKED}.{BLOCKED}.97.60:443
• {BLOCKED}.{BLOCKED}.97.60:443
• {BLOCKED}.{BLOCKED}.55.122:443
• {BLOCKED}.{BLOCKED}.228.144:443
• {BLOCKED}.{BLOCKED}.164.18:443
• {BLOCKED}.{BLOCKED}.206.204:443
• {BLOCKED}.{BLOCKED}.54.22:443
• {BLOCKED}.{BLOCKED}.229.49:443
• {BLOCKED}.{BLOCKED}.34.137:443
• {BLOCKED}.{BLOCKED}.96.30:443
• {BLOCKED}.{BLOCKED}.166.113:443
• {BLOCKED}.{BLOCKED}.10.23:443
• {BLOCKED}.{BLOCKED}.241.22:4443
• {BLOCKED}.{BLOCKED}.97.238:443
• {BLOCKED}.{BLOCKED}.169.163:4443
• {BLOCKED}.{BLOCKED}.157.139:443
• {BLOCKED}.{BLOCKED}.131.73:443
• {BLOCKED}.{BLOCKED}.241.22:4443
• {BLOCKED}.{BLOCKED}.199.58:4443
• {BLOCKED}.{BLOCKED}.164.18:443
• {BLOCKED}.{BLOCKED}.33.98:443
• {BLOCKED}.{BLOCKED}.129.153:4443
• {BLOCKED}.{BLOCKED}.129.218:4443
• {BLOCKED}.{BLOCKED}.144.195:4443
• {BLOCKED}.{BLOCKED}.35.92:443
• {BLOCKED}.{BLOCKED}.135.106:4443
• {BLOCKED}.{BLOCKED}.222.89:443
• {BLOCKED}.{BLOCKED}.170.118:443
• {BLOCKED}.{BLOCKED}.100.182:443
• {BLOCKED}.{BLOCKED}.18.149:443
• {BLOCKED}.{BLOCKED}.139.238:4443
• {BLOCKED}.{BLOCKED}.172.36:443
• {BLOCKED}.{BLOCKED}.73.151:4443
• {BLOCKED}.{BLOCKED}.55.122:443
• {BLOCKED}.{BLOCKED}.97.242:443
• {BLOCKED}.{BLOCKED}.165.229:443

It deletes itself after execution.