TSPY_BANKER.WSE

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

It modifies the Internet Explorer Zone Settings.

It does not have any downloading capability.

It logs a user's keystrokes to steal information.

However, as of this writing, the said sites are inaccessible. It deletes itself after execution.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following copies of itself into the affected system and executes them:

• %System%\{malware file name}

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
sysplar = "%System%\{malware file name}"

Propagation

This spyware does not have any propagation routine.

Backdoor Routine

This spyware does not have any backdoor routine.

Web Browser Home Page and Search Page Modification

This spyware modifies the Internet Explorer Zone Settings.

Dropping Routine

This spyware drops the following files:

• %System Root%\$$Delme$$.bat - deleted right away

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Download Routine

This spyware does not have any downloading capability.

Information Theft

This spyware logs a user's keystrokes to steal information.

Stolen Information

This spyware sends the gathered information via HTTP POST to the following URL:

• http://{BLOCKED}w.229.{BLOCKED}c.com/ie/ie.asp

Other Details

However, as of this writing, the said sites are inaccessible.

It deletes itself after execution.

NOTES:

It uses an Internet Explorer icon to trick the users into clicking the them.

It deletes all text files found in %Cookies%.

It attempts to steal information related to certain online accounts.

It steals the following information:

• Password
• Username
• Email
• Telephone number
• Card ID
• Card type
• Expiration date (month and year)
• Security code

It does not have rootkit capabilities.

It does not exploit any vulnerability.