TSPY_SPYEYE.TRF

This spyware may be downloaded by other malware/grayware/spyware from remote sites. It may be dropped by other malware.

It connects to a website to send and receive information.

It also has rootkit capabilities, which enables it to hide its processes and files from the user.

Arrival Details

This spyware may be downloaded by other malware/grayware/spyware from remote sites.

It may be dropped by other malware.

Installation

This spyware drops the following copies of itself into the affected system:

• %System Root%\portwexexe\portwexexe.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It drops the following non-malicious file:

• %System Root%\portwexexe\config.bin

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It creates the following folders:

• %System Root%\portwexexe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• __twxter__

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
portwexexe.exe = %System Root%\portwexexe\portwexexe.exe

Backdoor Routine

This spyware connects to the following websites to send and receive information:

• http://{BLOCKED}aper.net

Rootkit Capabilities

This spyware also has rootkit capabilities, which enables it to hide its processes and files from the user.

Other Details

This spyware connects to the following URL(s) to check for an Internet connection:

• www.microsoft.com

It does the following:

• It initially connects to the server by sending information using the following format:
  
  • http://{BLOCKED}aper.net/zpa1/zrgate13.php?guid={bot guid}&ver={bot version}&stat={bot status}&ie={IE version}&os={OS version}&ut={user type}&plg={plugin}&ccrc={crc of configuration file}&md5={md5 hash}
  Once a connection is established, it waits for commands from the server.
• It steals FTP accounts
• It steals POP3 accounts
• It steals certificates
• It captures screenshots
• It captures entered information in web forms
• It can perform webinjects in major browsers (e.g. Internet Explorer, Firefox, etc.)
• It automates the transfer of money in credit cards using the IP location