TSPY_KEYLOGGER.RA
TrojanSpy:MSIL/Hakey.A (Microsoft)
Windows
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Spyware
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
TECHNICAL DETAILS
Arrival Details
This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This spyware adds the following folders:
- %System%\Important
(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)
It drops the following copies of itself into the affected system and executes them:
- %System%\Important\svchost.exe
(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)
It drops the following files:
- %System%\Important\log.txt
(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)
It terminates the execution of the copy it initially executed and executes the copy it drops instead.
Autostart Technique
This spyware adds the following registry entries to enable its automatic execution at every system startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
CurrentVersion\Run
svchost = "%System%\svchost.exe"
Other System Modifications
This spyware modifies the following registry entries:
HKEY_CURRENT_USER\Software\Microsoft\
CurrentVersion\Explorer\Advanced
Hidden = "2"
(Note: The default value data of the said registry entry is 1.)
HKEY_CURRENT_USER\Software\Microsoft\
CurrentVersion\Explorer\Advanced
HideFileExt = "1"
(Note: The default value data of the said registry entry is 0.)