TSPY_BEBLOH.MJM

This spyware arrives onto users systems as a spoofed German invoice e-mail (payment confirmation for order).

This spyware may also use a purely random set of characters as its file name. It connects to certain servers to report system infection and send information such as OS version and IP address.

This spyware arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It gathers target email addresses from the Windows Address Book (WAB).

It deletes the initially executed copy of itself.

Arrival Details

This spyware arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Installation

This spyware drops the following copies of itself into the affected system:

• %System%\{random filename}.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• ASWgf02

It injects itself into the following processes as part of its memory residency routine:

• csrss.exe
• thebat.exe
• msimn.exe
• iexplore.exe
• explorer.exe
• myie.exe
• firefox.exe
• mozilla.exe
• avant.exe
• maxthon.exe
• OUTLOOK.EXE
• ftpte.exe
• coreftp.exe
• filezilla.exe
• TOTALCMD.EXE
• cftp.exe
• FTPVoyager.exe
• SmartFTP.exe
• WinSCP.exe

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
userinit.exe
Debugger = "%System%\{random filename}.exe"

Other System Modifications

This spyware adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
5.0\203E7401
Default = "{XOR encrypted configuration file URLs}"

It adds the following registry keys as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
5.0\203E7401

Propagation

This spyware gathers target email addresses from the Windows Address Book (WAB).

Information Theft

This spyware gathers the following data:

• IP Address
• OS Version
• Socks Port
• UAC Configuration
• Hardware ID

Drop Points

Stolen information is uploaded to the following websites:

• {BLOCKED}x.com

Other Details

This spyware deletes the initially executed copy of itself

NOTES:

A screenshot of the spammed email can be found below:

The file names used for its dropped copy may contain the following strings combined with random characters:

• def
• dns
• exec
• hlp
• logon
• mem
• mixer
• mon
• pack
• play
• setup
• srv
• user
• video
• win

It may also use a purely random set of characters as filename.

It monitors URLs related to financial institutions indicated in its configuration file, as well as steal FTP credentials from the infected system. If the download is successful, it may steal login credentials and money from bank accounts and manipulate the account page to display no changes in the account balance. However, the URLs currently are not accessible.