TSPY_ZBANKER.B

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It acts as a Browser Helper Object (BHO) that monitors a user's Internet-browsing habits.

It logs a user's keystrokes to steal information.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following files:

• %Program Files%\IEHelper\IeHelper.dll - also detected as TSPY_ZBANKER.B
• %User Profile%\IEHelper\visited.dat - log of visited target banking sites

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It drops the following copies of itself into the affected system:

• %System%\UpDate.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Its DLL component is injected to the following process(es):

• explorer.exe

It creates the following folders:

• %Program Files%\IEHelper
• %User Profile%\IEHelper

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
IEHelpRun = "%System%\UpDate.exe"

It registers itself as a BHO to ensure its automatic execution every time Internet Explorer is used by adding the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{BBC9FDC7-26C6-4BED-B907-68BD01C058E2}

It acts as a Browser Helper Object (BHO) that monitors a user's Internet-browsing habits.

Other System Modifications

This spyware adds the following registry keys:

HKEY_CLASSES_ROOT\CLSID\{BBC9FDC7-26C6-4BED-B907-68BD01C058E2}

HKEY_CLASSES_ROOT\Interface\{5D120EBF-7215-4665-BEBF-0FED811643AA}

HKEY_CLASSES_ROOT\TTIEBHO.IEHelper.1

HKEY_CLASSES_ROOT\TTIEBHO.TrackIE

HKEY_CLASSES_ROOT\TypeLib\{C8915F1F-B84E-4AA0-9648-E2CC8E4A194C}

Information Theft

This spyware gathers the following data:

• MAC address
• Internet explorer version
• Operating system version

It logs a user's keystrokes to steal information.

Stolen Information

This spyware sends the gathered information via HTTP POST to the following URL:

• http://www.{BLOCKED}123.com/tongji/count.asp?mac={MAC address}&iever={IE version}&os={OS version}

NOTES:

This spyware initially connects to the following URL in order to get target banking sites:

• http://www.{BLOCKED}n.co.kr/data/review/b9.txt

It monitors if the user access one of the following URLs from banking sites:

• https://obank1.kbstar.com/quics?page=C027221&weblog=introLogin
• https://obank.kbstar.com/quics?page=C027221&weblog=introLogin
• https://omoney.kbstar.com/quics?page=C018897
• https://obank1.kbstar.com/quics?page=C019935
• https://obiz.kbstar.com/quics?page=C015661
• http://pib.wooribank.com/pib/cus/wpcus900_01t.jsp
• http://www.hanabank.com/common/login.do

If the user access one of these URLs they are redirected to the following phishing pages that mimic the official banking sites, to get a user’s bank information, such as user names, passwords, or card codes:

• {BLOCKED}k.{BLOCKED}ar.com
• {BLOCKED}b.{BLOCKED}bank.com
• www.{BLOCKED}nk.com

It saves which banking sites have already been visited in %User Profile%\IEHelper\visited.dat.

It is also capable of capturing screen shots.