BAT_BANKER.ZIP

This spyware may be dropped by other malware.

It connects to certain websites to send and receive information.

Arrival Details

This spyware may be dropped by other malware.

Installation

This spyware drops the following component file(s):

• %User Temp%\{Computer Name}.txt - also detected as BAT_BANKER.ZIP (contains proxy settings)

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It drops the following non-malicious file:

• %User Temp%\ok.db - infection indicator

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Other System Modifications

This spyware modifies the following file(s):

• %Application Data%\Mozilla\Firefox\Profiles\{random}.default\prefs.js
• %Program Files%\Java\jre{version number}\lib\security\java.policy

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).)

It adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
AutoConfigURL = "file://%User Temp%\{Computer Name}.txt"

HKEY_CURRENT_USER\Software\Policies\
Microsoft\Internet Explorer\Control Panel
Autoconfig = "1"

HKEY_CURRENT_USER\Software\Policies\
Microsoft\Internet Explorer\Control Panel
AdvancedTab = "1"

HKEY_CURRENT_USER\Software\Policies\
Microsoft\Internet Explorer\Control Panel
ResetWebSettings = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Internet Explorer\MAIN
Extensions Off Page = "http://www.google.com.br"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Extensions Off Page = "http://www.google.com.br"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings
AutoConfigURL = "file://%User Temp%\{Computer Name}.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings
EnableHttp1_1 = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings
ProxyEnable = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings
ProxyHttp1.1 = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Google\Chrome
AllowOutdatePlugins = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Google\Chrome
AlwaysAuthorizePlugins = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Internet Explorer\Control Panel
AdvancedTab = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Internet Explorer\Control Panel
ResetWebSettings = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Internet Explorer\Control Panel
Autoconfig = "1"

It modifies the following registry entries:

HKEY_CURRENT_USER\Microsoft\Windows\
CurrentVersion\Internet Settings
ProxyEnable = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Microsoft\Windows\
CurrentVersion\Internet Settings
ProxyHttp1.1 = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntivirusDisableNotify = "1"

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = "1"

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesDisableNotify = "1"

(Note: The default value data of the said registry entry is 0.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SystemRestore
DisableSR = "1"

(Note: The default value data of the said registry entry is 0.)

Other Details

This spyware connects to the following website to send and receive information:

• http://{BLOCKED}.202.121/go3/{User Name}-{Computer Name}

NOTES:

It instructs browsers to retrieve pages with the following strings in their URLs through the following proxies on port 80:

• american
• bancodobrasil
• banese
• banrisul
• bb
• bnb
• br
• bradesco
• caixa
• cef
• cetelem
• citibank
• com
• credicard
• hsbc
• infoseg
• intouch
• itau
• linhadefensiva
• pagseguro
• paypal
• safra
• santanderempresarial
• santander
• securessl
• serasa
• sicredi
• tam
• tam.com
• voegol
• www2.bancobrasil
• xicaaa
• xicaaax
• xxxxxxx

For Proxy

• crashoverwing.me
• proxyrem.com
• teamview.us

It modifies %Application Data%\Mozilla\Firefox\Profiles\{random}.default\prefs.js to change the browser's proxy settings by adding the following lines:

• user_pref("network.{proxy}.autoconfig_url", "file://%User Temp%\{Computer Name}.txt");
• user_pref("network.{proxy}.type", 2);

It modifies %Program Files%\Java\jre{version number}\lib\security\java.policy to grant all permissions to Java Applets by overwriting the file with the following line:

• grant { permission java.security.AllPermission;};

It executes its component using the following command:

• {Java Runtine Environment path}\bin\jawaw.exe -jar %User Temp%\foto.gif - detected as JAVA_BANKER.ZIP