Threat Encyclopedia

TSPY_QBOT.L

Publish date: October 08, 2012

ANALYSIS BY

jasperm


PLATFORM:

Windows 2000, XP, Server 2003

OVERALL RISK RATING:
REPORTED INFECTION:
SYSTEM IMPACT RATING:
INFORMATION EXPOSURE:

  • Threat Type:Spyware

  • Destructiveness:No

  • Encrypted: Yes

  • In the wild: Yes

OVERVIEW


This spyware belongs to a multi-component malware.

It steals sensitive system information and sends the information to its C&C server.

It downloads its component files from certain websites, where it also sends its stolen information.

It terminates certain processes if found running in the affected system's memory.

This spyware may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

It also has rootkit capabilities, which enables it to hide its processes and files from the user.

It accesses websites to download files. This action allows this malware to possibly add other malware on the affected computer. It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system. It saves downloaded files into the said created folder.

It gathers certain information on the affected computer. It sends the information it gathers to remote sites.

TECHNICAL DETAILS

File Size:

99,840 bytes

File Type:

PE

Memory Resident:

Yes

Initial Samples Received Date:

11 Nov 2010

Payload:

Terminates processes, Downloads files, Compromises system security

Arrival Details

This spyware may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This spyware drops the following copies of itself into the affected system:

  • %System Root%\Documents and Settings\All Users\Application Data\Microsoft\qgewcjtlz\q1.{random number}

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It creates the following folders:

  • %System Root%\Documents and Settings\All Users\Application Data\Microsoft\qgewcjtlz

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Rootkit Capabilities

This spyware also has rootkit capabilities, which enables it to hide its processes and files from the user.

Process Termination

This spyware terminates the following processes if found running in the affected system's memory:

  • ccApp.exe
  • cmd.exe
  • ctfmon.exe
  • dbgview.exe
  • far.exe
  • mirc.exe
  • mmc.exe
  • msdev.exe
  • nc.exe
  • ollydbg.exe
  • outlook.exe
  • photoed
  • R&Q.exe
  • skype

Download Routine

This spyware accesses websites to download the following files:

  • aaveimi - detected as TROJ_BAMITAL.AQ
  • qgewcjtlz.exe - detected as TROJ_BAMITAL.AQ
  • qgewcjtl.dll - contains encrypted data
  • qgewcjtlz.dl - detected as TSPY_QBOT.N
  • qgewcjtlzyw.dll - detected as TSPY_QBOT.N
  • qgewcjtlzxn.exe - detected as TROJ_BAMITAL.AQ
  • xujqa2y - contains encrypted data

It connects to the following URL(s) to download its component file(s):

  • http://{BLOCKED}rver.com.ua/cgi-bin/ss.pl
  • http://{BLOCKED}rver.com.ua/cgi-bin/exhandler4.pl
  • http://{BLOCKED}owthewhistle.com/cgi-bin/clientinfo3.pl
  • http://{BLOCKED}6.in/cgi-bin/jl/jloader.pl
  • http://{BLOCKED}2.cn/cgi-bin/jl/jloader.pl

It saves the files it downloads using the following names:

  • alias__qbotnti.exe
  • alias__qbotinj.exe
  • alias__qbot.cb
  • _qbotinj.exe
  • _qbotnti.exe
  • q3.dll
  • _qbot.dll
  • alias__qbot.dll
  • crontab.cb
  • /u/updates98.cb
  • alias_updates.cb
  • /u/updates.cb
  • updates1.cb
  • updates*_new.cb

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

It saves downloaded files into the said created folder.

Information Theft

This spyware monitors the Internet Explorer (IE) activities of the affected system, specifically the address bar or title bar. It recreates a legitimate website with a spoofed login page if a user visits banking sites with the following strings in the address bar or title bar:

  • singlepoint.usbank.com
  • netconnect.bokf.com
  • business-eb.ibanking-services.com
  • cashproonline.bankofamerica.com
  • /cashplus/
  • ebanking-services.com
  • /cashman/
  • web-cashplus.com
  • treas-mgt.frostbank.com
  • business-eb.ibanking-services.com
  • treasury.pncbank.com
  • access.jpmorgan.com
  • ktt.key.com
  • onlineserv/CM
  • premierview.membersunited.org
  • directline4biz.com
  • onb.webcashmgmt.com
  • tmconnectweb
  • moneymanagergps.com
  • ibc.klikbca.com
  • directpay.wellsfargo.com
  • express.53.com
  • itreasury.regions.com
  • itreasurypr.regions.com
  • cpw-achweb.bankofamerica.com
  • businessaccess.citibank.citigroup.com
  • businessonline.huntington.com

It gathers the following information on the affected computer:

  • ext_ip
  • dnsname
  • hostname
  • country
  • state
  • city
  • user
  • domain
  • is_admin
  • os
  • time
  • qbot_version

It sends the information it gathers to remote sites.

Other Details

This spyware does the following:

  • It may be executed with the /f argument.
  • It may send the gathered information to the above-mentioned websites, where it downloads other component files.
  • It also sends the sensitive information it gathers to its C&C server.
  • It is capable of connecting to a certain IRC server using a certain port and joins a channel where it receives commands from a malicious user.

SOLUTION

Minimum Scan Engine:

8.900

FIRST VSAPI PATTERN FILE:

7.612.01

FIRST VSAPI PATTERN DATE:

11 Nov 2010

VSAPI OPR PATTERN File:

7.611.00

VSAPI OPR PATTERN Date:

10 Nov 2010

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Remove malware files dropped/downloaded by TSPY_QBOT.L

    TROJ_BAMITAL.AQ
    TSPY_QBOT.N

Step 3

Identify and delete files detected as TSPY_QBOT.L using either the Startup Disk or Recovery Console

[ Learn More ]

Step 4

Search and delete this folder

[ Learn More ]
Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden folders in the search result.
%System Root%\Documents and Settings\All Users\Application Data\Microsoft\qgewcjtlz

Step 5

Scan your computer with your Trend Micro product to delete files detected as TSPY_QBOT.L. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.

Featured Stories

Connect with us on