TSPY_ZBANKER.A

This malware is involved in attacks which targeted specific banking corporations in Korea during November 2012.

To get a one-glance comprehensive view of the behavior of this Spyware, refer to the Threat Diagram shown below.

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It acts as a Browser Helper Object (BHO) that monitors a user's Internet-browsing habits.

It logs a user's keystrokes to steal information.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following files:

• %Program Files%\IEHelper\IeHelper.dll - also detected as TSPY_ZBANKER.A
• %User Profile%\IEHelper\visited.dat - log of visited target banking sites

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It drops the following copies of itself into the affected system:

• %System%\UpDate.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Its DLL component is injected to the following process(es):

• explorer.exe

It creates the following folders:

• %Program Files%\IEHelper
• %User Profile%\IEHelper

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
IEHelpRun = "%System%\UpDate.exe"

It registers itself as a BHO to ensure its automatic execution every time Internet Explorer is used by adding the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{BBC9FDC7-26C6-4BED-B907-68BD01C058E2}

It acts as a Browser Helper Object (BHO) that monitors a user's Internet-browsing habits.

Other System Modifications

This spyware adds the following registry keys:

HKEY_CLASSES_ROOT\CLSID\{BBC9FDC7-26C6-4BED-B907-68BD01C058E2}

HKEY_CLASSES_ROOT\Interface\{5D120EBF-7215-4665-BEBF-0FED811643AA}

HKEY_CLASSES_ROOT\TTIEBHO.IEHelper.1

HKEY_CLASSES_ROOT\TTIEBHO.TrackIE

HKEY_CLASSES_ROOT\TypeLib\{C8915F1F-B84E-4AA0-9648-E2CC8E4A194C}

Information Theft

This spyware gathers the following data:

• MAC address
• Internet explorer version
• Operating system version

It logs a user's keystrokes to steal information.

Stolen Information

This spyware sends the gathered information via HTTP POST to the following URL:

• http://{BLOCKED}o.{BLOCKED}0.my5m.com/tongji/123321/count.asp?mac={MAC address}&iever={IE version}&os={OS version}

NOTES:
This spyware initially connects to the following URL in order to get target banking sites: http://www.{BLOCKED}l.{BLOCKED}o.kr/files/consult_common/etc/j.txt

It monitors if the user access one of the following URLs from banking sites:

• https://obank1.kbstar.com/quics?page=C027221&weblog=introLogin
• https://obank.kbstar.com/quics?page=C027221&weblog=introLogin
• https://omoney.kbstar.com/quics?page=C018897
• https://obank1.kbstar.com/quics?page=C019935
• https://obiz.kbstar.com/quics?page=C015661
• http://pib.wooribank.com/pib/cus/wpcus900_01t.jsp

If the user access one of these URLs they are redirected to the following phishing pages that mimic the official banking sites, to get a user’s bank information, such as user names, passwords, or card codes:

• {BLOCKED}k.{BLOCKED}star.com
• {BLOCKED}b.{BLOCKED}obank.com

It saves which banking sites have already been visited in ;%User Profile%\IEHelper\visited.dat.

It is also capable of capturing screen shots.