TSPY_SHIZ.MJSX

This spyware may be downloaded from remote sites by other malware.

It does not have any propagation routine.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This spyware may be downloaded from remote site(s) by the following malware:

• W2KM_SHIZ.MJSX

Installation

This spyware drops the following files:

• %AppDataLocal%\{random}.tmp.bat ← used to modify itself; deleted afterwards
• %Application Data%\{random folder}\{random filename}.txt ← logs files

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops and executes the following files:

• %All Users Profile%\Application Data \{random}.exe ← detected as TSPY_SHIZ.SMJX

(Note: %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following processes:

• svchost.exe

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\{3492473cd35c8bdceed8}
• {random string}

It injects codes into the following process(es):

• created svchost.exe

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
IntelPowerAgent{number} = "rundll32.exe shell32.dll, ShellExec_RunDLL %All Users Profile%\Application Data\{random}.exe"

Other System Modifications

This spyware adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows
{random} = "{hex value}"

Propagation

This spyware does not have any propagation routine.

Information Theft

This spyware gathers the following data:

• OS information
• Account Information of certain application
• Path of target process and its CRC
• Keystroke
• Clipboard
• Screenshots
• Running processes
• Network traffic
• Network user
• Installed system certificates
• Installed AV products
• Bitcoin wallet contents
• Litecoin wallet contents
• User Name
• Computer Name
• OS Install Date
• Cookies

Stolen Information

This spyware sends the gathered information via HTTP POST to the following URL:

• https://{BLOCKED}icworld.com/news/userlogin.php

Other Details

This spyware connects to the following URL(s) to check for an Internet connection:

• vk.com
• yandex.ru
• download.windowsupdate.com
• dropbox.com
• microsoft.com

It does the following:

• It terminates itself if it is being debugged.
• It terminates itself if the following files and directories are found:
  • %System Root%\sample\pos.exe
  • %System Root%\analysis\sandboxstarter.exe
  • %System Root%\analysis
  • %System Root%\insidetm
  • %System Root%\iDEFENSE
  • %System Root%\popupkiller.exe
  • %System Root%\tools\execute.exe
  • %System%\drivers\vmhgfs.sys
  • %System%\drivers\vmmouse.sys
  • %System%\drivers\vboxmouse.sys
• It terminates itself if the following network monitoring file is found:
  • \.\NPF_NdisWanIp
• It terminates itself if the following DLLs are loaded:
  • dbghelp.dll
  • api_log.dll
  • dir_watch.dll
  • pstorec.dll
• It sleeps if the following DLLs are loaded:
  • sbiedll.dll
  • snxhk.dll
• It terminates itself if the User Name or Computer Name of the machine is:
  • SANDBOX
  • FORTINET
  • VIRUS
  • MALWARE
  • MALNETVM
  • ANALYSERS
• It attempts to collect information when the following strings found in certain applications:
  • tellerplus
  • bancline
  • fidelity
  • micrsolv
  • bankman
  • vanity
  • episys
  • jack henry
  • cruisenet
  • gplusmain
  • silverlake
  • v48d0250s1
• It check installed AV product by searching the following registries:
  • HKEY_LOCAL_MACHINE\Microsoft\Microsoft Antimalware
  • HKEY_LOCAL_MACHINE\Software\Avg
  • HKEY_LOCAL_MACHINE\Software\G Data
  • HKEY_LOCAL_MACHINE\Software\Avira
  • HKEY_LOCAL_MACHINE\Software\AVAST
  • HKEY_LOCAL_MACHINE\Software\Avast
  • HKEY_LOCAL_MACHINE\Software\KasperskyLab\protected
  • HKEY_LOCAL_MACHINE\Software\Bitdefender
  • HKEY_LOCAL_MACHINE\Software\Panda Software
  • HKEY_LOCAL_MACHINE\Software\Sophos
  • HKEY_LOCAL_MACHINE\Software\Coranti
  • HKEY_LOCAL_MACHINE\Software\rising
  • HKEY_LOCAL_MACHINE\Software\TrendMicro
  • HKEY_LOCAL_MACHINE\Software\Symantec
  • HKEY_LOCAL_MACHINE\Software\ComodoGroup
  • HKEY_LOCAL_MACHINE\Software\Network Associates\TVD
  • HKEY_LOCAL_MACHINE\Software\Data Fellows\F-Secure
  • HKEY_LOCAL_MACHINE\Software\Eset\Nod
  • HKEY_LOCAL_MACHINE\Software\Softed\ViGUARD
  • HKEY_LOCAL_MACHINE\Software\Zone Labs\ZoneAlarm
  • HKEY_LOCAL_MACHINE\Software\VBA32
  • HKEY_LOCAL_MACHINE\Software\Doctor Web
• It collects data from files related to the following e-banking applications:
  • HBPData\hbp.profile
  • ELBA5\ELBA_data
  • Omikron\MCSign
• It searches the following process to check if the machine is a POS system:
  • pos.exe
  • bank.exe
• It monitors and intercept downloads done by the following process:
  • iexplore.exe
  • opera.exe
  • firefox.exe
  • chrome.exe
  • maxthon.exe
  • java.exe
  • javaw.exe
  • plugin-container.exe
  • acrobat.exe
  • acrod32.exe
• It hooks API to inject applications
• It may perform web injections and web parsing on injected browser
• It downloads file

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

However, as of this writing, the said sites are inaccessible.