TSPY_AIBATOOK.AM

This spyware arrives as a component bundled with malware/grayware packages.

It connects to certain websites to send and receive information.

Arrival Details

This spyware arrives as a component bundled with malware/grayware packages.

Installation

This spyware drops the following files:

• %System Root%\a.dat
• %System%\midimapbits.dll - detected as TSPY_AIBATOOK.AM
• %Windows%\Temp\version361.dat
• %Windows%\Temp\98768515.txt - detected as TSPY_AIBATOOK.AM
• %Windows%\Temp\version.dat
• %User Temp%\Low\ietest.ini
• %UserTemp%\ieversion.dat
• %UserTemp%\gameenabled.jpg
• %UserTemp%\winurl.dat
• %UserTemp%\version.dat

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
v3configure = "rundll32.exe %Windows%\Temp\98768515.txt,A"

Download Routine

This spyware accesses the following websites to download files:

• http://{BLOCKED}data.com/images/ja525.jpg - config (download URL)
• http://{compromisedsite}/{uri}/ja525.jpg - config (download URL)
• http://{BLOCKED}.{BLOCKED}4.35.58/531.gif - detected as TSPY_AIBATOOK.AM url from config

It connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}g.co.jp/bbs/images/admin32.gif - inaccessible

It saves the files it downloads using the following names:

• %User Temp%\ahnMse64.dll
• %User Temp%\ahnMse32.dll

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Stolen Information

This spyware saves the stolen information in the following file:

• %User Temp%\d3d8d4.ini

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Drop Points

Stolen information is uploaded to the following websites:

• http://{BLOCKED}ews.or.kr/xe/bbs/board.php
• http://{BLOCKED}ng.co.kr/bbs5/zboard.php

Other Details

This spyware connects to the following website to send and receive information:

• http://{BLOCKED}data.com/eng/test/jp{number}.php?m={value}&os={os version}&ie{browser information}

NOTES:

It monitors traffic from the following browsers:

• iexplore.exe
• firefox.exe
• chrome.exe

It captures information (username/password) matched using the following set of strings.

• _PAGEID=
• _SENDTS=
• KEIYAKU_NO=
• PASSWORD=

• _PAGEID=
• _SENDTS=
• KAKUNIN_NO=

• domainSumitomo=
• USRID=
• USRID1=
• USRID2=
• PASSWORD=

• TrxID=
• V_OTPW_PASSWORD=
• PASSWD2_1=
• PASSWD2_2=

• event=
• okyakusamaBangou1=
• okyakusamaBangou2=
• okyakusamaBangou3=
• pm_fp=

• event=
• aikotoba=
• pm_fp=

• event=
• loginPassword=
• pm_fp=

• event=
• shouninAnshouBangou=

• KeiyakuNo=
• Next=
• pm_fp=

• NLS=
• Anshu1No=
• jsAware=

• NLS=
• Anshu2=
• Anshu2_2=
• Anshu2_3=
• Anshu2_4=
• pm_fp=

• NLS=
• InknKzBox=
• InknKzNo=
• InputThrKn=
• pm_fp=

• jsAware=
• NLS=
• rskAns=

It queries the execution path of the following games

• Duke Nukem Forever
• Maple Story
• Lineage

It locates and execute the uninstaller of the following applications:

• Trendmicro Titanium
• Naver Vaccine
• V3 365 Clinic
• V3 Lite
• Eset Smart Security