TSPY_FASTPOS.A

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It injects its dropped file/component to specific processes.

It logs a user's keystrokes to steal information.

It connects to certain websites to send and receive information. It deletes the initially executed copy of itself. It gathers information and reports it to its servers.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following copies of itself into the affected system and executes them:

• %Windows%\servhelp.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It drops the following file(s)/component(s):

• {Current Malware Path}\kl32.exe <- temporary file for the keylog module 32bit
• {Current Malware Path}\kl64.exe <- temporary file for the keylog module 64bit
• {Current Malware Path}\proc32.exe <- temporary file for the memory scraper module 32bit
• {Current Malware Path}\proc64.exe <- temporary file for the memory scraper module 64bit
• {Current Malware Path}\service.exe <- temporary file for the Main Loader
  
  (Note: These files will be deleted when OS checking is done and the appropriate module (x32/x64) is copied to the windows directory)

It drops and executes the following files:

• %Windows%\kbd.exe <- keylog module (x32/x64 bit depending of the affected system OS)
• %Windows%\servproc.exe <- memory scraper module (x32/x64 bit depending of the affected system OS)
• %Windows%\serv32.exe <- Main Loader, executes the keylog and memory scraper module, reports to C&C server

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• CLAXCSSPLS

It injects its dropped file/component to the following processes:

• explorer.exe
  (Note: The component to be injected is the keylogging module %Windows%\kbd.exe)

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It terminates the execution of the copy it initially executed and executes the copy it drops instead.

Autostart Technique

This spyware adds and runs the following services:

• Service Name: Windows Update Helper
  Display Name: Windows Update Helper
  Start Type: SERVICE_AUTO_START
  Binary Pathname: %Windows%\serv32.exe
• Service Name: Windows Update Process
  Display Name: Windows Update Process
  Start Type: SERVICE_AUTO_START
  Binary Pathname: %Windows%\servproc.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

Other System Modifications

This spyware adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Clax
UID = "{victim unique id}"

Information Theft

This spyware gathers the following data:

• Keylogs
• Credit Card Track Data

It logs a user's keystrokes to steal information.

Other Details

This spyware connects to the following website to send and receive information:

• http://{BLOCKED}viejoinc.com//cdosys.php?comdlg64=newcomputer&username={victim user name}&computername={victim computer name}&os={victim os}&architecture={victim os architecture}&uid={victim unique id}&version=1
• http://{BLOCKED}viejoinc.com//cdosys.php?comdlg64=statuslog&log=kbinjected&uid={victim unique id}&version=1
• http://{BLOCKED}viejoinc.com//cdosys.php?comdlg64=statuslog&log=procinstalled
• http://{BLOCKED}viejoinc.com//cdosys.php?comdlg64=statuslog&log=scan
• http://{BLOCKED}viejoinc.com//cdosys.php?comdlg64=addcc&log={card information dump}&foundin={process name}
• http://{BLOCKED}viejoinc.com//cdosys.php?comdlg64=statuslog&log=errorrpm{error info}
• http://{BLOCKED}viejoinc.com//cdosys.php?comdlg64=statuslog&log=errorsendLogStr
• http://{BLOCKED}viejoinc.com//cdosys.php?comdlg64=statuslog&log=ping&uid={victim unique id}&version=1

It does the following:

• Elevate the privilege for %Windows%\kbd.exe in order to inject it to explorer.exe
• Creates a MailSlot as a communication medium between its modules and storage for stolen information:
  • \\.\mailslot\trackslot
• Performs memory scraping on all processes to check for card track data
• Displays message boxes of either successful or failed installation of itself and its components
  • Example:

    

It deletes the initially executed copy of itself

It gathers the following information and reports it to its servers:

• User Name
• Computer Name
• OS Version and Architecture
• Victim's Unique ID
• Log reports of its activity