Trojan:Win32/EyeStye.N

Trojan:Win32/EyeStye.N is a trojan that captures keystrokes, monitors Internet activity and steals certain login credentials and sends the captured data is sent to a remote attacker for financial gain. The trojan may download additional malware, lower web browser security and use a rootkit to hide its malicious activity.

System changes

The following system changes may indicate the presence of this malware:

The presence of the following files:
c:\recycle.bin\recycle.bin.exe
c:\recycle.bin\config.bin
c:\rcss.bin\rcss.bin.exe
c:\rcss.bin\config.bin
c:\poooooooasi\<random name>.exe
c:\montes\montes.exe
c:\montes\config.bin
c:\system.bin\<random name>.exe
c:\system.bin\config.bin
c:\systemtools\<random name>.exe
C:\recycle.bin\<random name>.exe
Alert notifications or detections of this malware from installed antivirus or security software may be the only other symptoms.

Trojan:Win32/EyeStye.N is a trojan that captures keystrokes, monitors Internet activity and steals certain login credentials and sends the captured data is sent to a remote attacker for financial gain. The trojan may download additional malware, lower web browser security and use a rootkit to hide its malicious activity.

Installation

The trojan may be installed by other malware such as TrojanDropper:Win32/EyeStye, TrojanDownloader:Win32/Bredolab, TrojanDownloader:Win32/Waledac and Backdoor:Win32/Kelihos. When run, the trojan creates a unique mutex to ensure only one instance of the trojan executes. In the wild, we have observed the trojan using the following mutexes:

settingstravell
SystemBoot
SystemSrv
Global\__Recycle__
Global\LateFix
Global\LocksNA
Global\Skype
Global\SPYNET
Global\SystemMo
Global\SysMsg
Global\system1
Global\SystemService
Global\TaskExp
Global\WindowsServices
zXeRY3a_PtW|00000000

Trojan:Win32/EyeStye.N creates the following files on an affected computer:

c:\recycle.bin\recycle.bin.exe
c:\recycle.bin\config.bin
c:\rcss.bin\rcss.bin.exe
c:\rcss.bin\config.bin
c:\poooooooasi\<random name>.exe
c:\montes\montes.exe
c:\montes\config.bin
c:\system.bin\<random name>.exe
c:\system.bin\config.bin
c:\systemtools\<random name>.exe
C:\recycle.bin\<random name>.exe

Note: < system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP, Vista, and 7 is C:\Windows\System32.

The malware utilizes code injection in order to hinder detection and removal. When Trojan:Win32/EyeStye.N executes, it may inject code into running processes, including the following, for example:

cmd.exe
DRWEB32.EXE
explorer.exe
lsass.exe
svchost.exe
winlogon.exe
wmiprvse.exe

Payload

Uses stealth techniques
Win32/EyeStye employs a user-mode rootkit that hooks the following low-level APIs to hide its malicious files, directory and registry data:

NtQueryDirectoryFile
NtVdmControl
NtEnumerateValueKey
NtSetInformationFile

Steals login credentials
When a user visits certain Internet banking sites and enters login credentials, Trojan:Win32/EyeStye.N captures the credentials using a technique known as "form grabbing". The trojan hooks several system APIs to capture login information, such as online banking credentials, web form data and keystrokes. Win32/EyeStye.N hooks the following APIs:

TranslateMessage
NtResumeThread
LdrLoadDll
InternetCloseHandle
HttpSendRequestA
HttpSendRequestW
PR_Write
send
CryptEncrypt
PFXImportCertStore
InternetQueryOptionA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpQueryInfoA
InternetReadFile
InternetQueryDataAvailable
InternetWriteFile
InternetReadFileExA

By hooking the APIs mentioned above, the trojan can also inject malicious code into existing and new processes. This behavior assists the trojan to monitor the loading of DLLs and manipulate the information sent and received through the Internet. The trojan attempts to send captured data via HTTP POST to a remote server for collection by an attacker for financial gain. In the wild, we have observed this trojan connecting to one of the following remote servers:

totdisseny.net
burgermannnn7719.biz
188.72.201.213
195.88.191.44
212.150.164.200
213.155.31.136
46.166.131.160
46.4.73.27
74.50.98.160
80.91.191.228
95.168.178.220
adbuleoncacc.info
alunionylogen.ru
analservice.eu
aniani.info/cp
bannedcellebs.biz
bezdarniki.com
californication.co.cc
domonisteriosters.info
frandiss.ru
fullfreepoker.eu
gallopusik.ru
globallaty.ru
gone4awalk.co.cc
heartmusicjojo.co.cc
host-checkker.net
lenuki.ru/forum
musictherealsouldx.ru
nowtorrent.ru
raz7pi7zop.com
strflproject.com
webawoke.com
wefwef34.cz.cc
eyesecurr657444.net
youarelucky.ru

The trojan attempts to access login pages of popular websites such as "facebook.com" to capture the password of users of infected systems. While sending captured data, it may include the following other information:

Bot guid - unique identifier associated with the trojan
Trojan:Win32/EyeStye.N version
User name and privilege
Computer name
Volume serial number
Process name associated with captured data
Name of hooked API function (for example PR_Write)
Captured raw data
Keys logged (keystrokes)
Other information specific to computer locale such as:
- Local time and t ime zone
- Operating system language, version and service pack
- Web browser(s) used and version

Lowers browser security
The trojan modifies registry data that lowers security settings in Internet Explorer Internet Zones and also allows the browser to access data sources across domains.

In the following subkeys:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4

Sets value: "1409"

To data: "3"

In the following subkeys:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4

Sets value: "1406"

To data: "0"

Trojan:Win32/Eystye.N disables the Phishing Filter in Internet Explorer by modifying registry data.

In subkey: HKCU\Software\Microsoft\Internet Explorer\PhishingFilter

Sets value: " EnabledV8"
With data: "0"

The trojan modifies other registry data to ensure that Internet Explorer launches in online mode.

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings

Adds value: " GlobalUserOffline"
With data: "0"

Deletes web browser history

The trojan deletes web browser history by modifying registry data to clear history when exiting Internet Explorer.

In subkey: HKCU\Software\Microsoft\Internet Explorer\Recovery

Adds value: " ClearBrowsingHistoryOnExit"
With data: "0"

Download updates and arbitrary files
Trojan:Win32/EyeStye.N attempts to connect to one of the servers previously mentioned and await commands from a remote attacker. Commands could include instructing the trojan to download arbitrary files that can include updates of the trojan. Successfully downloaded executable files are saved as the following and then run:

<Current directory>\<file name>.exe\<file name>upd.exe

Trojan:Win32/EyeStye.N may also update a configuration file stored in ZIP archive file format as the following:

<Current directory>\<file name>.exe \config.bin

The trojan communicates via a mutexes named " __<MUTEX NAME>_UNINSTALL__" and "__<MUTEX NAME>_RELOADCFG__" to instruct existing instances of malicious code in memory to " reload data", " uninstall", (and other actions) from the new configuration file. This allows the trojan and associated components access to a new remote server.

Analysis by Tim Liu and Zarestel Ferrer

Trojan:Win32/EyeStye.N

On this page

Summary

Symptoms

System changes

Technical Information (Analysis)

Installation

Payload

相关阅读

相关文章

相关问答