TROJ_SPYEYE.SMEP

As of this writing, the said sites are inaccessible.

It attempts to steal sensitive online banking information, such as user names and passwords. This routine risks the exposure of the user's account information, which may then lead to the unauthorized use of the stolen data.

Installation

This Trojan drops the following files:

• %Application Data%\{random folder name 2}\{random file name}.osb - non-malicious file

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It drops the following copies of itself into the affected system:

• %Application Data%\{random folder name 1}\{random file name}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It creates the following folders:

• %Application Data%\{random folder name 1}
• %Application Data%\{random folder name 2}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It injects itself into the following processes as part of its memory residency routine:

• explorer.exe

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{CLSID} = %Application Data%\{random folder name 1}\{random file name}.exe

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
{random key}

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}u.co.cc/soft.exe
• http://{BLOCKED}u.co.cc/pov.exe

As of this writing, the said sites are inaccessible.

Information Theft

This Trojan attempts to steal sensitive online banking information, such as user names and passwords. This routine risks the exposure of the user's account information, which may then lead to the unauthorized use of the stolen data.

Other Details

This Trojan did not exhibit backdoor routines during testing.