Trojan:Win32/EyeStye.N
(?)Updated: Aug 08, 2011 | Published: Mar 09, 2011
Aliases
Not available
Alert Level (?)
Severe
Antimalware protection details
Microsoft recommends that you download the latest definitions to get protected.
Detection last updated: Definition: 1.111.939.0 Released: Aug 28, 2011 |
Detection initially created: Definition: 1.103.286.0 Released: Apr 22, 2011 |
Summary
Symptoms
System changes
-
The presence of the following files:
c:\recycle.bin\recycle.bin.exe
c:\recycle.bin\config.bin
c:\rcss.bin\rcss.bin.exe
c:\rcss.bin\config.bin
c:\poooooooasi\<random name>.exe
c:\montes\montes.exe
c:\montes\config.bin
c:\system.bin\<random name>.exe
c:\system.bin\config.bin
c:\systemtools\<random name>.exe
C:\recycle.bin\<random name>.exe -
Alert notifications or detections of this malware from installed antivirus or security software may be the only other symptoms.
Technical Information (Analysis)
Installation
-
settingstravell
-
SystemBoot
-
SystemSrv
-
Global\__Recycle__
-
Global\LateFix
-
Global\LocksNA
-
Global\Skype
-
Global\SPYNET
-
Global\SystemMo
-
Global\SysMsg
-
Global\system1
-
Global\SystemService
-
Global\TaskExp
-
Global\WindowsServices
-
zXeRY3a_PtW|00000000
-
c:\recycle.bin\recycle.bin.exe
-
c:\recycle.bin\config.bin
-
c:\rcss.bin\rcss.bin.exe
-
c:\rcss.bin\config.bin
-
c:\poooooooasi\<random name>.exe
-
c:\montes\montes.exe
-
c:\montes\config.bin
-
c:\system.bin\<random name>.exe
-
c:\system.bin\config.bin
-
c:\systemtools\<random name>.exe
-
C:\recycle.bin\<random name>.exe
- cmd.exe
- DRWEB32.EXE
- explorer.exe
- lsass.exe
- svchost.exe
- winlogon.exe
- wmiprvse.exe
Payload
Uses stealth techniques
Win32/EyeStye employs a user-mode rootkit that hooks the following low-level
APIs to hide its malicious files, directory and
registry data:
NtQueryDirectoryFile
NtVdmControl
NtEnumerateValueKey
NtSetInformationFile
Steals login credentials
When a user visits certain Internet banking sites and enters login credentials,
Trojan:Win32/EyeStye.N captures the credentials using a technique known as "form grabbing". The trojan hooks several system
APIs to capture login information, such as online banking credentials, web form data and keystrokes. Win32/EyeStye.N hooks the following
APIs:
TranslateMessage
NtResumeThread
LdrLoadDll
InternetCloseHandle
HttpSendRequestA
HttpSendRequestW
PR_Write
send
CryptEncrypt
PFXImportCertStore
InternetQueryOptionA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpQueryInfoA
InternetReadFile
InternetQueryDataAvailable
InternetWriteFile
InternetReadFileExA
By hooking the APIs mentioned above, the trojan can also inject malicious code into existing and new processes. This behavior assists the trojan to monitor the loading of DLLs and manipulate the information sent and received through the Internet. The trojan attempts to send captured data via HTTP POST to a remote server for collection by an attacker for financial gain. In the wild, we have observed this trojan connecting to one of the following remote servers:
-
totdisseny.net
-
burgermannnn7719.biz
-
188.72.201.213
-
195.88.191.44
-
212.150.164.200
-
213.155.31.136
-
46.166.131.160
-
46.4.73.27
-
74.50.98.160
-
80.91.191.228
-
95.168.178.220
-
adbuleoncacc.info
-
alunionylogen.ru
-
analservice.eu
-
aniani.info/cp
-
bannedcellebs.biz
-
bezdarniki.com
-
californication.co.cc
-
domonisteriosters.info
-
frandiss.ru
-
fullfreepoker.eu
-
gallopusik.ru
-
globallaty.ru
-
gone4awalk.co.cc
-
heartmusicjojo.co.cc
-
host-checkker.net
-
lenuki.ru/forum
-
musictherealsouldx.ru
-
nowtorrent.ru
-
raz7pi7zop.com
-
strflproject.com
-
webawoke.com
-
wefwef34.cz.cc
-
eyesecurr657444.net
-
youarelucky.ru
The trojan attempts to access login pages of popular websites such as "facebook.com" to capture the password of users of infected systems. While sending captured data, it may include the following other information:
-
Bot guid - unique identifier associated with the trojan
-
Trojan:Win32/EyeStye.N version
-
User name and privilege
-
Computer name
-
Volume serial number
-
Process name associated with captured data
-
Name of hooked API function (for example PR_Write)
-
Captured raw data
-
Keys logged (keystrokes)
-
Other information specific to computer locale such as:
-
Local time and t ime zone
-
Operating system language, version and service pack
-
Web browser(s) used and version
-
The trojan modifies registry data that lowers security settings in Internet Explorer Internet Zones and also allows the browser to access data sources across domains.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
With data: "0"
With data: "0"
With data: "0"
Trojan:Win32/EyeStye.N attempts to connect to one of the servers previously mentioned and await commands from a remote attacker. Commands could include instructing the trojan to download arbitrary files that can include updates of the trojan. Successfully downloaded executable files are saved as the following and then run:
Analysis by Tim Liu and Zarestel Ferrer