SYMBOS_EXY.A

This spyware may be unknowingly downloaded by a user while visiting malicious websites.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Arrival Details

This spyware may be unknowingly downloaded by a user while visiting malicious websites.

Autostart Technique

This spyware drops the following files:

• C:\sys\bin\Installer_SV.exe
• C:\sys\bin\LanPackage.exe
• C:\private\101f875a\import\[20028B98].rsc

Download Routine

This spyware then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Other Details

Based on analysis of the codes, it has the following capabilities:

• Creates the semaphore,EConServerSemaphore_0x20028B98 to ensure that only one instance of itself is running in memory.
• Creates the temporary files: C:\system\data\Local_Para.txt,C:\system\data\Remote_Para.txt,C:\system\data\NotPure.txt,C:\system\data\SisInfo.cfg and C:\system\data\Source.ini
• Gathers information such as phone type, IMEI number, and IMSI number
• It has the following certificate: Issued by Symbian CA I. Subject: Beijing GuoShengMingDao Technology Co. Ltd Issued to LanPackage_5 2.0.0. Valid from 24/08/2009 to 25/08/2019. Issued by VeriSign Testing-Based ACS Root for Symbian OS. Issued to Symbian Limited. Valid from 14/03/2007 to 27/08/2023.
• Silently installs an updated variant by visiting the website, http://{BLOCKED}y.com/Kernel.jsp?Version=2.0&PhoneType={phone type}&PhoneImei={IMEI num}&PhomeImsi={IMSI num}&Source={other parameter}
• Saves and executes the downloaded file as C:\private\20028B98\kel.sisx, which is detected as SYMBOS_YXES.D
• Accesses the website, http://{BLOCKED}y.com/KernelPara.jsp?Version=2.0&PhoneType={phone type}&PhoneImei={IMEI num}&PhomeImsi={IMSI num}&Source={other parameter} to download an encrypted data which is saved as C:\system\data\Kernel_Para.txt.
• Propagates by sending SMS messages with a link to a copy of itself to the list of numbers collected from the phone's contact list.
• Sends the gathered information to the server, http://{BLOCKED}y.com/Jump.jsp?Version=2.0&PhoneType={phone type}&PhoneImei={IMEI num}&PhomeImsi={IMSI num}&Source={other parameter}. The server then replies with a redirection to the website, http://{BLOCKED}pie.com.
• Terminates the following processes if found running in the affected system's memory: AppMngr, TaskSpy, Y-Tasks, ActiveFile, and TaskMan.