TSPY_SPCESEND.R

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following copies of itself into the affected system:

• %AppDataLocal%\Intel\Intel Volume\Stub\did.vine - modified copy of itself

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following files:

• %AppDataLocal%\scout\scout.exe - also detected as TSPY_SPCESEND.R
• %AppDataLocal%\scout\IntelRST.zip - contains two EXE files that are also detected as TSPY_SPCESEND.R
• %AppDataLocal%\scout\Information.zip
• If processes related to Norton anti-virus is found running:
  
  • %AppDataLocal%\Intel\Intel Volume\nor.txt
  • %AppDataLocal%\Intel\Intel Volume\frmmem.exe - one of the two EXE files in the archive
  • %System%\Tasks\Intel® RST - scheduled task for frmmem.exe
• If processes related to AVG is found running:
  
  • %AppDataLocal%\Intel\Intel Volume\avg.txt
  • %AppDataLocal%\Intel\Intel Volume\IntelRST.exe - one of the two EXE files in the archive
  • %System%\Tasks\Intel® RST - scheduled task for IntelRST.exe
  If none of the above:
  
  • %AppDataLocal%\Intel\Intel Volume\IntelRST.exe
  • %System%\Tasks\Intel® RST - scheduled task for IntelRST.exe
• %System%\Tasks\scout - scheduled task for scout.exe
• %AppDataLocal%\Intel\Intel Volume\7za.txt

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It drops and executes the following files:

• {malware path}\loading table.xlsx

It creates the following folders:

• %AppDataLocal%\scout
• %AppDataLocal%\Intel
• %AppDataLocal%\Intel\Intel Volume
• %AppDataLocal%\Intel\Intel Volume\Lab
• %AppDataLocal%\Intel\Intel Volume\icon - contains images of icons
• %AppDataLocal%\Intel\Intel Volume\Stub
• %AppDataLocal%\Intel\Intel Volume\z - storage of archive of collected files
• %AppDataLocal%\Intel\Intel Volume\{Drive letter}{Drive type}{Current date}{Current time} - copies of collected files
• %AppDataLocal%\Intel®

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• 6b1627de-5072-41da-b1ad-0446c737916a

Process Termination

This spyware terminates the following processes if found running in the affected system's memory:

• IntelRST - it will only terminate this process if the file version of this file is less than 1.9.1.2

Other Details

This spyware connects to the following URL(s) to check for an Internet connection:

• http://www.google.com

NOTES:

If the malware successfully terminated the process "IntelRST", it will delete the following files/folders:

• %AppDataLocal%\Intel\Intel Volume\Stub
• %AppDataLocal%\Intel\Intel Volume\Information.zip
• %AppDataLocal%\Intel\Intel Volume\IntelRST.exe
• %AppDataLocal%\Intel\Intel Volume\7za
• %AppDataLocal%\Intel\Intel Volume\icon
• %AppDataLocal%\Intel\Intel Volume\Lab
• %AppDataLocal%\Intel®

It uses Windows Task Scheduler to add the following scheduled tasks (Name, definition, target, trigger):

• Intel® RST, Intel Rapid Storage Technology, %AppDataLocal%\Intel\Intel Volume\IntelRST.exe, 3 minutes after user logs in
• Intel® RST, Intel Rapid Storage Technology, %AppDataLocal%\Intel\Intel Volume\IntelRST.exe, 3 minutes after user logs in
• scout, Monitor and repair, %AppDataLocal%\scout\scout.exe, 2 minutes after user logs in

It checks the following processes if its running in the system:

• Related to Norton:
  • NTS
  • nav
• Related to AVG:
  • avgui
  • avguix

It collects installed anti-virus products.

It also collects the following document files from fixed and network drives:

• .doc
• .docx
• .ppt
• .pptx
• .pdf
• .xls
• .xlsx

It tries to create the following directory in each of the fixed or network drives to check the user's access rights:

• {Drive}:\temp - this directory will be deleted afterwards

It also collects all files found in the following directory:

• {Removable Drive}:\$System Volume Information

It archives(ZIP) the collected files and saves it as:

• %AppDataLocal%\Intel\Intel Volume\z\{random characters}

It checks for a specific website connections(stops if successfully connected to one):

• http://coreupdate.{BLOCKED}pdates.com:46769
• http://msupdates.{BLOCKED}soft.com:46769
• http://updateserver.{BLOCKED}pdates.eu:46769

Then it sends the archive to the aforementioned websites using the following address:

• {mentioned websites}/Gtvty@/ins3rtsummervine.php?FolderName={Processor ID}-{Board serial number}-{Computer name}({User name})~{User code}

It also accesses the following addresses with the intention of sending/receiving information:

• {mentioned websites}/Gvty@/v1ned1sfile.php?FolderName={ProcessorID}-{Board serial number}-{Computer name}({User name})~{User code}
• {mentioned websites}/Gvty@/scout.php?Value={number}&FolderName={ProcessorID}-{Board serial number}-{Computer name}({User name})~{User code}{Report} where {Report} depends on the {number}:
  • If {number} is 2, {Report} is "&AntiViral={Installed anti-virus products}{Current date}"
  • If {number} is 1, {Report} is "&Status=1 {Current date}"

It is capable of deleting the Task Schedule(s) it created.