TSPY_CARBERP.E

Trend Micro has flagged this spyware as noteworthy due to the increased potential for damage, propagation, or both, that it possesses. Specifically, this spyware sends sensitive data to a remote host.

To get a one-glance comprehensive view of the behavior of this Spyware, refer to the Threat Diagram shown below.

This spyware may be downloaded by other malware/grayware/spyware from remote sites. It may be unknowingly downloaded by a user while visiting malicious websites.

It hides files, processes, and/or registry entries.

It connects to certain URLs. It may do this to remotely inform a malicious user of its installation. It may also do this to download possibly malicious files onto the computer, which puts the computer at a greater risk of infection by other threats.

It deletes itself after execution.

Arrival Details

This spyware may be downloaded by other malware/grayware/spyware from remote sites.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This spyware drops the following copies of itself into the affected system:

• %User Startup%\chkntfs.exe

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

It is injected into the following processes running in memory:

• svchost.exe

Rootkit Capabilities

This spyware hides files, processes, and/or registry entries.

Download Routine

This spyware connects to the following malicious URLs:

• http://oollma.com/set/task.html

It accesses the following websites to download files:

• http://oollma.com/cfg/miniav.plug
• http://oollma.com/cfg/passw.plug
• http://oollma.com/cfg/stopav.plug

Other Details

This spyware does the following:

• Monitors the following wininet.DLL APIs to monitor the internet browsing activities in the affected system:
  • InternetReadFiles
  • InternetCloseHandle
  • HttpSendRequestA
  • HttpSendRequestW
  • InternetReadFileExA
  • InternetReadFileExW
  • HttpSendRequestExA
  • HttpSendRequestExW
• Collects the following information and sends it to http://oollma.com/get/gra.html via HTTP Post:
  • Email
  • POP3 User Name
  • POP3 Password
  • POP3 Server
  • SMTP User Name
  • SMTP Server
• Searches for all running processes and sends the list to the following remote site via HTTP Post:
  • http://oollma.com/set/first.html

It deletes itself after execution.