TSPY_DELF.PWY

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes registry entries, causing some applications and programs to not function properly.

It does not have any propagation routine.

It does not have any backdoor routine.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy drops the following copies of itself into the affected system:

• %Program Files%\Internet Explorer\OnlO0r.bak

(Note: %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.)

Other System Modifications

This Trojan Spy deletes the following files:

• %System%\drivers\etc\hosts

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{CC3596CB-D6C1-ECA1-AE51-DEEA63F6C21C}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{CC3596CB-D6C1-ECA1-AE51-DEEA63F6C21C}\InProcServer32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{C2626E66-D21B-E628-C1DF-1DACCFA36ED2}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{C2626E66-D21B-E628-C1DF-1DACCFA36ED2}\InProcServer32

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{6C7596CB-31CC-BBA3-BE51-2EEA62F9C51D}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{6C7596CB-31CC-BBA3-BE51-2EEA62F9C51D}\InProcServer32

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{C2626E66-D21B-E628-C1DF-1DACCFA36ED2}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
*\shellex\ContextMenuHandlers\
ReliveHookDLL

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{CC3596CB-D6C1-ECA1-AE51-DEEA63F6C21C}\InProcServer32
(Default) = %Program Files%\Internet Explorer\OnlO0r.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{CC3596CB-D6C1-ECA1-AE51-DEEA63F6C21C}\InProcServer32
ThreadingModel = Apartment

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{C2626E66-D21B-E628-C1DF-1DACCFA36ED2}\InProcServer32
(Default) = %Program Files%\Common Files\fjOs0r.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{C2626E66-D21B-E628-C1DF-1DACCFA36ED2}\InProcServer32
ThreadingModel = Apartment

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{6C7596CB-31CC-BBA3-BE51-2EEA62F9C51D}\InProcServer32
(Default) = %Program Files%\Common Files\fjOs0r.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{6C7596CB-31CC-BBA3-BE51-2EEA62F9C51D}\InProcServer32
ThreadingModel = Apartment

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
*\shellex\ContextMenuHandlers\
ReliveHookDLL
(Default) = {6C7596CB-31CC-BBA3-BE51-2EEA62F9C51D}

It deletes the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
ShellExecuteHooks
{AEB6717E-7E19-11d0-97EE-00C04FD91972} = ""

Propagation

This Trojan Spy does not have any propagation routine.

Backdoor Routine

This Trojan Spy does not have any backdoor routine.

Rootkit Capabilities

This Trojan Spy does not have rootkit capabilities.

Dropping Routine

This Trojan Spy drops the following files:

• %Program Files%\Internet Explorer\OnlO0r.dll - detected as TSPY_DELF.HWP
• %Program Files%\Common Files\fjOs0r.dl - detected as TSPY_DELF.HWP

(Note: %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.)

It executes the dropped file. As a result, malicious routines of the dropped file are exhibited on the affected system.

Other Details

This Trojan Spy does the following:

• It prevents certain antivirus programs from running at every system startup. It searches the affected system's registry for related registry keys to get the installation paths of core files of certain antivirus programs.
  Once the installation paths are obtained, it creates certain folders with Hidden and System attributes and uses a legitimate Windows file name.
  • {Install Path}\ws2_32.dll for the following registries:
    • HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\SetupFolders\KAV2006
    • HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\Framework\Installed Path
    • HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SharedUsage\LiveUpdate
    • HKEY_LOCAL_MACHINE\SOFTWARE\rising\Rav\installpath
    • HKEY_LOCAL_MACHINE\SOFTWARE\Kingsoft\AntiVirus\ProgramPath
    • HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\InstalledProducts\Kaspersky Anti-Virus Personal\Folder
  • {Install Path}\AntiVirus\ws2_32.dll for the following registry:
    • HKEY_LOCAL_MACHINE\SOFTWARE\JiangMin\InstallPath
  • {Install Path}\MFC42.DLL for the following registry:
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe\Path
• It also renames the main file of another antivirus program to prevent from running at startup. It does the said routine by searching for the following registry key to obtain the installation path:
  • HKEY_LOCAL_MACHINE\SOFTWARE\Eset\Nod\CurrentVersion\Info\InstallDir
  
  Once installation path is known, it renames the file {Install path}\NOD32.000 to {Install path}\NOD32.000.BAK.

It does not exploit any vulnerability.