TSPY_CHISBURG.A

This malware uses an AutoIT packer, a scripting language leveraged by cybercriminals. It has the capability to propagate via drives and steals user names and passwords from Yahoo, Hotmail, and Pidgin among others.

To get a one-glance comprehensive view of the behavior of this Spyware, refer to the Threat Diagram shown below.

This spyware arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Arrival Details

This spyware arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Installation

This spyware drops the following files:

• %User Temp%\{10 random alphanumeric characters}.ini
• %User Profile%\Xp21237W81223\{random filename and extension}
• %User Profile%\Mf88749K80827.WV7

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It drops the following copies of itself into the affected system:

• %User Profile%\Xp21237W81223\explorer.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It creates the following folders:

• %User Profile%\Xp21237W81223

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
Ic98367G37760 = "%User Profile%\Xp21237W81223\explorer.exe"

Propagation

This spyware drops copies of itself in the following drives:

• {drive letter}:\explorer.exe - All drives

Stolen Information

This spyware sends the gathered information via HTTP POST to the following URL:

• http://{BLOCKED}ber123.hostingsiteforfree.com/index.php?action=add&username={username}&password={password}&app={application}&pcname={computername}&sitename={url of credentials}

NOTES:

It steals user names and passwords from the following:

• Internet Download Manager
• jDownloader
• VPN/ISP Credentials
• Trillian Messenger
• Yahoo
• Hotmail
• Pidgin
• FileZilla
• Registry/website/application defined in %User Temp%\{10 random alphanumeric characters}.ini

It sleeps for approximately 15 seconds when there's a running AvastUI.exe application.