TSPY_SPYEYE.WKT

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It also has rootkit capabilities, which enables it to hide its processes and files from the user.

It modifies the Internet Explorer Zone Settings.

It attempts to steal sensitive online banking information, such as user names and passwords. This routine risks the exposure of the user's account information, which may then lead to the unauthorized use of the stolen data. It steals certain information from the system and/or the user.

It connects to certain websites to send and receive information. It deletes the initially executed copy of itself.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following component file(s):

• %System Root%\sy5tw21.bin\{random filename}

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It drops the following copies of itself into the affected system:

• %System Root%\sy5tw21.bin\{random filename}.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It creates the following folders:

• %System Root%\sy5tw21.bin

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random} = %System Root%\sy5tw21.bin\{random file name}.exe

Other System Modifications

This spyware adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\PhishingFilter
EnabledV8 = 0

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\PhishingFilter
ShownServiceDownBalloon = 0

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Recovery
ClearBrowsingHistoryOnExit = 0

Rootkit Capabilities

This spyware also has rootkit capabilities, which enables it to hide its processes and files from the user.

Web Browser Home Page and Search Page Modification

This spyware modifies the Internet Explorer Zone Settings.

Information Theft

This spyware attempts to steal sensitive online banking information, such as user names and passwords. This routine risks the exposure of the user's account information, which may then lead to the unauthorized use of the stolen data.

It steals the following information:

• Operating System Information
• Internet Explorer version
• Account Type
• Volume information
• Language ID
• Timezone
• Local Time

Other Details

This spyware connects to the following website to send and receive information:

• http://{BLOCKED}storag3.com:8080/pic1s0fs.php
• http://{BLOCKED}kos.co.cc:8080/pic1s0fs.php
• http://{BLOCKED}2rerew.co.cc:8080/pic1s0fs.php
• http://{BLOCKED}hu56j7kfbnm.cz.cc:8080/pic1s0fs.php
• http://{BLOCKED}7ib7k67iddro.cx.cc:8080/pic1s0fs.php
• http://{BLOCKED}kn78k67rvjyro.co.cc:8080/pic1s0fs.php
• http://{BLOCKED}bjyrturtyuk.info:8080/pic1s0fs.php
• http://{BLOCKED}bjyrturtyuk.org:8080/pic1s0fs.php
• http://{BLOCKED}yfhfgjdfghjil.cn:8080/pic1s0fs.php
• http://{BLOCKED}yfhfgjdfghjil.com:8080/pic1s0fs.php
• http://{BLOCKED}rturtyuk.com:8080/pic1s0fs.php

It does the following:

• Update configuration file
• Update itself
• Modify Internet Setting Zones
• Modify Mozilla Firefox preference file
• Log keystrokes
• Fill form data
• Steal FTP and POP3 user names and passwords
• Capture entered information in web forms

It deletes the initially executed copy of itself