TROJ_CARBERP.C

This Trojan may be downloaded by other malware/grayware/spyware from remote sites. It may be unknowingly downloaded by a user while visiting malicious websites.

It gathers certain information on the affected computer. It attempts to steal information, such as user names and passwords, used when logging into certain banking or finance-related websites.

It connects to certain websites to send and receive information.

Arrival Details

This Trojan may be downloaded by other malware/grayware/spyware from remote sites.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This Trojan drops the following component file(s):

• %User Startup%\chkntfs.dat - configuration file

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

It injects threads into the following normal process(es):

• svchost.exe
• Explorer.exe

Autostart Technique

This Trojan drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• chkntfs.exe

Backdoor Routine

This Trojan opens the following port(s) where it listens for remote commands:

• Port 80

Information Theft

This Trojan monitors the Internet Explorer (IE) activities of the affected system, specifically the address bar or title bar. It recreates a legitimate website with a spoofed login page if a user visits banking sites with the following strings in the address bar or title bar:

• https://banking.postbank.de/
• https://internetbanking.gad.de/

It gathers the following information on the affected computer:

• User name
• Operating system
• Computer name
• Host name
• Country
• Language
• Time
• Windows Product Key
• Uptime
• Hard disk Information
• Running Processes

It attempts to steal information from the following banks and/or other financial institutions:

• Postbank
• GAD

Stolen Information

This Trojan sends the gathered information via HTTP POST to the following URL:

• https://{BLOCKED}ox.org/tiger/CMP/xort3h47Far.php

Other Details

This Trojan connects to the following website to send and receive information:

• {BLOCKED}m.com
• {BLOCKED}send.com
• {BLOCKED}rld-auto.org

It does the following:

• It hooks the following NTDLL.DLL APIs to hide itself and its component files:
  
  • NtQueryDirectoryFile
  • NtResume Thread
• It hooks the following WININET.DLL APIs to monitor the Internet browsing activities in the affected system:
  
  • InternetCloseHandle
  • HttpSendRequestA
  • InternetReadFile
  • HttpSendRequestExW
  • InternetQueryDataAvailable
  • InternetReadFileExW
  • InternetReadFileExA
  • HttpSendRequestW
  • HttpSendRequestExA
• It terminates the following applications related to security:
  
  • ArcaVir
  • Avast
  • AVG
  • Avira
  • BitDefender
  • Dr. Web
  • ESET
  • ESET Smart Security
  • McAfee
  • Microsoft Security Essentials
  • Sophos
• It also removes the following malware:
  
  • Barracuda
  • BlackEnergy
  • Adrenalin
  • Zeus
  • Limbo
• It is capable of capturing screenshots and monitor browing activities.
• It steals user credentials used in the following applications:
  
  • AIM Pro
  • AOL
  • Apple Safari
  • ASP.NET Account
  • BitKinex
  • Bullet Proof FTP
  • Cached Passwords
  • Camfrog
  • Cisco Systems VPN Clients
  • Classic FTP
  • CoffeeCup FTP
  • Core FTP
  • Cryer Web Site Publisher
  • CuteFTP
  • Digsby
  • Directory Opus
  • Eudora
  • Excite Messenger
  • ExpanDrive
  • FAR Manager FTP
  • FFFTP
  • FileZilla
  • FlashFXP
  • Fling FTP
  • Forte Agent
  • Freecall
  • FreeFTP
  • Frigate 3
  • FTP Commander
  • FTP Explorer
  • FTP Rush
  • FTP Uploader
  • Gadu-gadu
  • Gizmo
  • Gmail
  • Google Chrome
  • Google Talk
  • GroupMail
  • ICQ
  • IncrediMail
  • Jabber
  • JAJC
  • LeapFTP
  • Mail Commander
  • Mail.Ru
  • Microsoft Outlook
  • Miranda
  • Mozilla Firefox
  • MSN Messenger
  • My Space IM
  • Napster
  • Odigo Messenger
  • Opera
  • PalTalk
  • Pandion
  • PC Remote Control
  • Pidgin
  • Poco Mail
  • Pop Peeper
  • PSI
  • QIP
  • Remote Desktop Connections
  • RimArts Becky! Internet Mail
  • Scribe Mail
  • SecureFX
  • SmartFTP
  • SoftX FTP
  • The Bat!
  • Total Commander
  • Trillian Astra
  • Ultra FXP
  • Vypress Auvis
  • Windows Credentials
  • Windows Live Mail
  • Windows Live Messenger
  • WinSCP
  • WinVNC3
  • WS_FTP
  • Yahoo!
  • zFTP

Variant Information

This Trojan has the following MD5 hashes:

• 174fbdd1d1d86fdd1b8c08191c3c5b38

It has the following SHA1 hashes:

• 570555036571300f10040ba92a22876d5a23264d