Infection Channel: Downloaded from the Internet, Dropped by other malware
This malware is reported to be involved with a malicious campaign concerning the 2012 US Presidential Election. Users affected by this malware may find their online banking credentials stolen.
To get a one-glance comprehensive view of the behavior of this Spyware, refer to the Threat Diagram shown below.
This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It is injected into all running processes to remain memory resident.
It modifies the Internet Explorer Zone Settings.
As of this writing, the said sites are inaccessible.
It deletes the initially executed copy of itself.
File size: 330,240 bytes
File type: EXE
Memory resident: Yes
Initial samples received date: 10 Oct 2012
Payload: Downloads files, Steals information
Arrival Details
This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This spyware drops the following copies of itself into the affected system:
- %User Profile%\Application Data\{random1}\{random}.exe
(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)
It drops the following files:
- %User Profile%\Application Data\Microsoft\Address Book\winxp.wab
(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)
It creates the following folders:
- %User Profile%\Application Data\{random1}
- %User Profile%\Application Data\Microsoft\Address Book
(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)
It is injected into all running processes to remain memory resident.
Autostart Technique
This spyware adds the following registry entries to enable its automatic execution at every system startup:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random CLSID} = "%User Profile%\Application Data\{random1}\{random}.exe"
Other System Modifications
This spyware adds the following registry keys:
HKEY_CURRENT_USER\Software\Microsoft\
{random}
HKEY_CURRENT_USER\Software\Microsoft\
WAB
It creates the following registry entry(ies) to bypass Windows Firewall:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Windows%\explorer.exe = "%Windows%\explorer.exe:*:Enabled:Windows Explorer"
Web Browser Home Page and Search Page Modification
This spyware modifies the Internet Explorer Zone Settings.
Download Routine
This spyware connects to the following URL(s) to download its configuration file:
- http://{pseudorandom alpha characters}.biz
- http://{pseudorandom alpha characters}.org
- http://{pseudorandom alpha characters}.info
- http://{pseudorandom alpha characters}.net
- http://{pseudorandom alpha characters}.ru
- http://{pseudorandom alpha characters}.com
As of this writing, the said sites are inaccessible.
Other Details
This spyware connects to the following URL(s) to check for an Internet connection:
- http://www.google.com/
- http://www.bing.com/
It deletes the initially executed copy of itself
NOTES:
The URL where it connects to is randomly generated using a randomizing function, which is computed based on the system's current date. The download file is the configuration file that contains the list of sites to be monitored.
The configuration file may contain URLs where it downloads an updated copy of itself and where it sends its gathered information. It may also contain URLs of its target online banking and finance-related sites from where it steals the information.
Connect with us on
| | | |