TSPY_PINCAV.GEK

TSPY_PINCAV.GEK is the Trend Micro detection for the new banking Trojan family known as Tatanga. According to media reports, it is capable of hijacking the user’s banking session to automatically transfer money to mules.

To get a one-glance comprehensive view of the behavior of this Spyware, refer to the Threat Diagram shown below.

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following copies of itself into the affected system:

• %Application Data%\Microsoft\Internet Explorer\report.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It drops the following files:

• %Application Data%\Help\a.dll - non-malicious file
• %Application Data%\Help\d.dll - non-malicious file
• %Application Data%\Help\n.dll - non-malicious file
• %Application Data%\Help\o.dll - non-malicious file
• %Application Data%\Help\p.dll - non-malicious file
• %System%\drivers\atmapi.sys - non-malicious file
• %User Temp%\worklog0 - non-malicious file

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It drops the following component file(s):

• %User Temp%\report.dll - also detected as TSPY_PINCAV.GEK

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It injects itself into the following processes as part of its memory residency routine:

• explorer.exe

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
BBCE27AD173B4CA0782D8C9B8A58441888790257E3384094375ADA29BB204E03 = "%Application Data%\Microsoft\Internet Explorer\report.exe"

Other System Modifications

This spyware adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Driversx

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Driversx64

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\WOW

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Wbem\WMIC
WMICLC = "{random value}"

HKEY_CURRENT_USER\Software\Microsoft\
Wbem\WMIC
mofcompMUIStatus = "{random value}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
MaxConnectionsPer1_0Server = "64"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
MaxConnectionsPerServer = "64"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Driversx
%Application Data%\Help\d.dll = "033f587c"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Driversx64
%Application Data%\Help\a.dll = "03659445"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Driversx64
%Application Data%\Help\d.dll = "033f587c"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Driversx64
%Application Data%\Help\n.dll = "01662dcb"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Driversx64
%Application Data%\Help\o.dll = "0310d42e"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Driversx64
%Application Data%\Help\p.dll = "043ea255"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\WOW
MID = "{random hexadecimal digits}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
WBEM\WMIC
mofcompstatus = "{random number}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
WBEM\WMIC
Cli.mof = "127856016000000000"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
WBEM\WMIC
CliEgAliases.mof = "127856016000000000"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
WBEM\WMIC
CliEgAliases.mfl = "127856016000000000"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Terminal Server\Licensing Core
EnableConcurrentSessions = "1"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Terminal Server
fDenyTSConnections = "0"

(Note: The default value data of the said registry entry is 1.)

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Windows%\explorer.exe = "%Windows%\explorer.exe:*:Enabled:explorer"

Backdoor Routine

This spyware executes the following commands from a remote malicious user:

• startos/stopos - set registry values defined by the C&C server
• reboot/winkill - restart the computer
• die - delete self
• proclist - enumerate running processes
• clearcookies - clears cookies of Chrome and Firefox browsers. Also deletes the cache
• kill - terminate process
• Cmd - execute %Temp%\123.cmd
• softstat - check if anti-virus softwares are installed
• instsoft - lists installed softwares and their versions, as well as enumerating Uninstall registries

(Note: %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp or C:\WINNT\Temp.)

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}esam.com/com/c.php
• http://{BLOCKED}esam.com/com/d.php
• http://{BLOCKED}arlet.com/com/c.php
• http://{BLOCKED}arlet.com/com/d.php

Other Details

This spyware does the following:

• It keeps information of each client, including all the installed software, city/region/country information, process list of running processes, and uptime.
• It prevents Trusteer Rapport from being downloaded.
• It blocks the anti-virus application installed in the system.
• It removes ZeuS malware infection from an infected computer.