TSPY_DYRE.NHV
PWS:Win32/Dyzap.Q (Microsoft); RDN/Generic PWS.y!b2e (McAfee); Trojan/Win32.Dyre (AhnLab-V3); Trojan.Win32.Battdil.T (Baidu-International); Win32/Battdil.T (ESET-NOD32)
Windows
Threat Type: Spyware
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It deletes itself after execution.
TECHNICAL DETAILS
552,448 bytes
EXE
12 Jun 2015
Arrival Details
This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This spyware drops the following files:
- %System%\config\systemprofile\Application Data\bq5uzce1f3.dll (for Windows XP and lower)
- %AppDataLocal%\bq5uzce1f3.dll (for Windows Vista and higher)
(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)
It drops the following copies of itself into the affected system:
- %Windows%\{random filename}.exe (for Windows XP and lower)
- %AppDataLocal%\{random filename}.exe (for Vista and higher)
(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)
Autostart Technique
This spyware registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\ge
ImagePath = "%Windows%\{random Filename}.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\ge
DisplayName = "Google Update"
It adds the following registry entries to enable its automatic execution at every system startup:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
GoogleUpdate = "%AppDataLocal%\{random filename}.exe"
It registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\ge (for Windows XP and lower)
Other Details
This spyware connects to the following possibly malicious URL:
- {BLOCKED}.{BLOCKED}.81.96:4443
- {BLOCKED}.{BLOCKED}.190.84:443
- {BLOCKED}.{BLOCKED}.191.213:443
- {BLOCKED}.{BLOCKED}.153.216:443
- {BLOCKED}.{BLOCKED}.201.9:443
- {BLOCKED}.{BLOCKED}.219.35:443
- {BLOCKED}.{BLOCKED}.152.131:443
- {BLOCKED}.{BLOCKED}.23.130:443
- {BLOCKED}.{BLOCKED}.235.48:443
- {BLOCKED}.{BLOCKED}.170.118:443
- {BLOCKED}.{BLOCKED}.97.141:443
- {BLOCKED}.{BLOCKED}.154.243:443
- {BLOCKED}.{BLOCKED}.97.60:443
- {BLOCKED}.{BLOCKED}.97.60:443
- {BLOCKED}.{BLOCKED}.55.122:443
- {BLOCKED}.{BLOCKED}.228.144:443
- {BLOCKED}.{BLOCKED}.164.18:443
- {BLOCKED}.{BLOCKED}.206.204:443
- {BLOCKED}.{BLOCKED}.54.22:443
- {BLOCKED}.{BLOCKED}.229.49:443
- {BLOCKED}.{BLOCKED}.34.137:443
- {BLOCKED}.{BLOCKED}.96.30:443
- {BLOCKED}.{BLOCKED}.166.113:443
- {BLOCKED}.{BLOCKED}.10.23:443
- {BLOCKED}.{BLOCKED}.241.22:4443
- {BLOCKED}.{BLOCKED}.97.238:443
- {BLOCKED}.{BLOCKED}.169.163:4443
- {BLOCKED}.{BLOCKED}.157.139:443
- {BLOCKED}.{BLOCKED}.131.73:443
- {BLOCKED}.{BLOCKED}.241.22:4443
- {BLOCKED}.{BLOCKED}.199.58:4443
- {BLOCKED}.{BLOCKED}.164.18:443
- {BLOCKED}.{BLOCKED}.33.98:443
- {BLOCKED}.{BLOCKED}.129.153:4443
- {BLOCKED}.{BLOCKED}.129.218:4443
- {BLOCKED}.{BLOCKED}.144.195:4443
- {BLOCKED}.{BLOCKED}.35.92:443
- {BLOCKED}.{BLOCKED}.135.106:4443
- {BLOCKED}.{BLOCKED}.222.89:443
- {BLOCKED}.{BLOCKED}.170.118:443
- {BLOCKED}.{BLOCKED}.100.182:443
- {BLOCKED}.{BLOCKED}.18.149:443
- {BLOCKED}.{BLOCKED}.139.238:4443
- {BLOCKED}.{BLOCKED}.172.36:443
- {BLOCKED}.{BLOCKED}.73.151:4443
- {BLOCKED}.{BLOCKED}.55.122:443
- {BLOCKED}.{BLOCKED}.97.242:443
- {BLOCKED}.{BLOCKED}.165.229:443
It deletes itself after execution.