TSPY_FASTPOS.A
Windows
Threat Type: Spyware
Destructiveness: No
Encrypted: No
In the wild: Yes
OVERVIEW
This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It injects its dropped file/component to specific processes.
It logs a user's keystrokes to steal information.
It connects to certain websites to send and receive information. It deletes the initially executed copy of itself. It gathers information and reports it to its servers.
TECHNICAL DETAILS
Arrival Details
This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This spyware drops the following copies of itself into the affected system and executes them:
- %Windows%\servhelp.exe
(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)
It drops the following file(s)/component(s):
- {Current Malware Path}\kl32.exe <- temporary file for the keylog module 32bit
- {Current Malware Path}\kl64.exe <- temporary file for the keylog module 64bit
- {Current Malware Path}\proc32.exe <- temporary file for the memory scraper module 32bit
- {Current Malware Path}\proc64.exe <- temporary file for the memory scraper module 64bit
- {Current Malware Path}\service.exe <- temporary file for the Main Loader
(Note: These files will be deleted when OS checking is done and the appropriate module (x32/x64) is copied to the windows directory)
It drops and executes the following files:
- %Windows%\kbd.exe <- keylog module (x32/x64 bit depending of the affected system OS)
- %Windows%\servproc.exe <- memory scraper module (x32/x64 bit depending of the affected system OS)
- %Windows%\serv32.exe <- Main Loader, executes the keylog and memory scraper module, reports to C&C server
(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)
It adds the following mutexes to ensure that only one of its copies runs at any one time:
- CLAXCSSPLS
It injects its dropped file/component to the following processes:
- explorer.exe
(Note: The component to be injected is the keylogging module %Windows%\kbd.exe)
(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)
It terminates the execution of the copy it initially executed and executes the copy it drops instead.
Autostart Technique
This spyware adds and runs the following services:
- Service Name: Windows Update Helper
Display Name: Windows Update Helper
Start Type: SERVICE_AUTO_START
Binary Pathname: %Windows%\serv32.exe - Service Name: Windows Update Process
Display Name: Windows Update Process
Start Type: SERVICE_AUTO_START
Binary Pathname: %Windows%\servproc.exe
(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)
Other System Modifications
This spyware adds the following registry entries as part of its installation routine:
HKEY_LOCAL_MACHINE\SOFTWARE\Clax
UID = "{victim unique id}"
Information Theft
This spyware gathers the following data:
- Keylogs
- Credit Card Track Data
It logs a user's keystrokes to steal information.
Other Details
This spyware connects to the following website to send and receive information:
- http://{BLOCKED}viejoinc.com//cdosys.php?comdlg64=newcomputer&username={victim user name}&computername={victim computer name}&os={victim os}&architecture={victim os architecture}&uid={victim unique id}&version=1
- http://{BLOCKED}viejoinc.com//cdosys.php?comdlg64=statuslog&log=kbinjected&uid={victim unique id}&version=1
- http://{BLOCKED}viejoinc.com//cdosys.php?comdlg64=statuslog&log=procinstalled
- http://{BLOCKED}viejoinc.com//cdosys.php?comdlg64=statuslog&log=scan
- http://{BLOCKED}viejoinc.com//cdosys.php?comdlg64=addcc&log={card information dump}&foundin={process name}
- http://{BLOCKED}viejoinc.com//cdosys.php?comdlg64=statuslog&log=errorrpm{error info}
- http://{BLOCKED}viejoinc.com//cdosys.php?comdlg64=statuslog&log=errorsendLogStr
- http://{BLOCKED}viejoinc.com//cdosys.php?comdlg64=statuslog&log=ping&uid={victim unique id}&version=1
It does the following:
- Elevate the privilege for %Windows%\kbd.exe in order to inject it to explorer.exe
- Creates a MailSlot as a communication medium between its modules and storage for stolen information:
- \\.\mailslot\trackslot
- Performs memory scraping on all processes to check for card track data
- Displays message boxes of either successful or failed installation of itself and its components
- Example:
It deletes the initially executed copy of itself
It gathers the following information and reports it to its servers:
- User Name
- Computer Name
- OS Version and Architecture
- Victim's Unique ID
- Log reports of its activity
SOLUTION
Step 1
Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.
Step 2
Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.
Step 3
Restart in Safe Mode
Step 4
Disable this malware service
- Windows Update Helper
- Windows Update Process
Step 5
Delete this registry key
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_LOCAL_MACHINE\SOFTWARE
- Clax
- Clax
Step 6
Search and delete this file
- %Windows%\kbd.exe
- %Windows%\servproc.exe
- %Windows%\serv32.exe
Step 7
Restart in normal mode and scan your computer with your Trend Micro product for files detected as TSPY_FASTPOS.A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.