TSPY_KEYLOGGER.RA

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware adds the following folders:

• %System%\Important

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It drops the following copies of itself into the affected system and executes them:

• %System%\Important\svchost.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It drops the following files:

• %System%\Important\log.txt

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It terminates the execution of the copy it initially executed and executes the copy it drops instead.

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
CurrentVersion\Run
svchost = "%System%\svchost.exe"

Other System Modifications

This spyware modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
CurrentVersion\Explorer\Advanced
Hidden = "2"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
CurrentVersion\Explorer\Advanced
HideFileExt = "1"

(Note: The default value data of the said registry entry is 0.)