TSPY_SHIZ.JH

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It modifies the Internet Explorer Zone Settings.

It connects to certain websites to send and receive information. It is used to load and execute a file.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following files:

• %Application Data%\{random}.tmp.bat
• %Application Data%\{random characters 1} - contains logs of running applications and accessed applications.

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops and executes the following files:

• %All Users Profile%\{random}.exe - detected as TSPY_SHIZ.SMJH

(Note: %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It injects codes into the following process(es):

• explorer.exe

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
IntelPowerAgent{random character} = rundll32.exe shell32.dll, ShellExec_RunDLL %All Users Profile%\{random}.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
(Default) = rundll32.exe shell32.dll, ShellExec_RunDLL %All Users Profile%\{random}.exe

Other System Modifications

This spyware adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows
{random number} = {hex values}

HKEY_CURRENT_USER\Software\Microsoft\
Windows
{random number} = %All Users Profile%\{random}.exe

Web Browser Home Page and Search Page Modification

This spyware modifies the Internet Explorer Zone Settings.

Stolen Information

This spyware saves the stolen information in the following file:

• %Application Data%\{random characters 2}.tmp - zip file of all files of all collected information in the system

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other Details

This spyware connects to the following URL(s) to check for an Internet connection:

• download.windowsupdate.com
• vk.com
• yandex.ru

It connects to the following website to send and receive information:

• http://{BLOCKED}bpj.com/news/userlogin.php
• http://{BLOCKED}bpj.com/news/userpanel.php

It is used to load and execute the following file:

• %All Users Profile%\{random}.exe
  executed using the following command:
  
  • svchost.exe %All Users Profile%\{random}.exe
  • Uses wscript.exe if svchost.exe is not found.

(Note: %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It does the following:

• Collects confidential information entered into browsers such as login username and password
• Collects the location of the dropped file and its crc
• Logs keystroke
• Collects system information:
  
  • active processes
  • network traffic
  • network user
• Collects information about installed system certificates
• Collects information about installed security programs
• Collects Bitcoin\ALTCoin wallet information
• Take screenshots

NOTES:

It has the following anti-emulation and anti-debugging techniques:

• terminates itself if its being debugged.
• terminates itself if the following files are found:
  
  c:\sample\pos.exe
  c:\analysis\sandboxstarter.exe
  c:\analysis
  c:\insidetm
  c:\iDEFENSE
  c:\popupkiller.exe
  c:\tools\execute.exe
  %Systems%\drivers\vmmouse.sys
  %Systems%\drivers\vmhgfs.sys
  %Systems%\drivers\vboxmouse.sys
• terminates itself if the following DLLs are loaded:
  
  dbghelp.dll (vmware)
  api_log.dll (SunBelt SandBox)
  dir_watch.dll (SunBelt SandBox)
  pstorec.dll (SunBelt Sandbox)
• Sleeps if the following DLLs are loaded:
  
  snxhk.dll (Avast)
  sbiedll.dll (Sandboxie)
• terminates itself if the User Name or Computer Name of the machine is:
  
  SANDBOX
  VIRUS
  MALNETVM
  MALWARE
  FORTINET

It deletes the files containing all information collected and the .ZIP file, %Application Data%\{random characters 2}.tmp, after sending a POST to its C&C.