http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3AWin32%2FEyeStye.N&ThreatID=-2147322129

Trojan:Win32/EyeStye.N

(?)

Encyclopedia entry
Updated: Aug 08, 2011  |  Published: Mar 09, 2011

Aliases
Not available

Alert Level (?)
Severe

Antimalware protection details
Microsoft recommends that you download the latest definitions to get protected.

Detection last updated:
Definition: 1.111.939.0
Released: Aug 28, 2011 Detection initially created:
Definition: 1.103.286.0
Released: Apr 22, 2011

---

On this page

Summary|Symptoms|Technical Information|Prevention|Recovery

---

 

Summary

Trojan:Win32/EyeStye.N is a trojan that captures keystrokes, monitors Internet activity and steals certain login credentials and sends the captured data is sent to a remote attacker for financial gain. The trojan may download additional malware, lower web browser security and use a rootkit to hide its malicious activity.

Top

---

 

Symptoms

System changes

The following system changes may indicate the presence of this malware:

• The presence of the following files:
  c:\recycle.bin\recycle.bin.exe
  c:\recycle.bin\config.bin
  c:\rcss.bin\rcss.bin.exe
  c:\rcss.bin\config.bin
  c:\poooooooasi\<random name>.exe
  c:\montes\montes.exe
  c:\montes\config.bin
  c:\system.bin\<random name>.exe
  c:\system.bin\config.bin
  c:\systemtools\<random name>.exe
  C:\recycle.bin\<random name>.exe
  
• Alert notifications or detections of this malware from installed antivirus or security software may be the only other symptoms.

Top

---

 

Technical Information (Analysis)

Trojan:Win32/EyeStye.N is a trojan that captures keystrokes, monitors Internet activity and steals certain login credentials and sends the captured data is sent to a remote attacker for financial gain. The trojan may download additional malware, lower web browser security and use a rootkit to hide its malicious activity.

Installation

The trojan may be installed by other malware such as TrojanDropper:Win32/EyeStye,TrojanDownloader:Win32/Bredolab,TrojanDownloader:Win32/Waledac and Backdoor:Win32/Kelihos. When run, the trojan creates a unique mutex to ensure only one instance of the trojan executes. In the wild, we have observed the trojan using the followingmutexes:

• settingstravell
• SystemBoot
• SystemSrv
• Global\__Recycle__
• Global\LateFix
• Global\LocksNA
• Global\Skype
• Global\SPYNET
• Global\SystemMo
• Global\SysMsg
• Global\system1
• Global\SystemService
• Global\TaskExp
• Global\WindowsServices
• zXeRY3a_PtW|00000000

Trojan:Win32/EyeStye.N creates the following files on an affected computer:

 

• c:\recycle.bin\recycle.bin.exe
• c:\recycle.bin\config.bin
• c:\rcss.bin\rcss.bin.exe
• c:\rcss.bin\config.bin
• c:\poooooooasi\<random name>.exe
• c:\montes\montes.exe
• c:\montes\config.bin
• c:\system.bin\<random name>.exe
• c:\system.bin\config.bin
• c:\systemtools\<random name>.exe
• C:\recycle.bin\<random name>.exe

 

Note: <system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP, Vista, and 7 is C:\Windows\System32.

 

The malware utilizes code injection in order to hinder detection and removal. WhenTrojan:Win32/EyeStye.N executes, it may inject code into running processes, including the following, for example:

• cmd.exe
• DRWEB32.EXE
• explorer.exe
• lsass.exe
• svchost.exe
• winlogon.exe
• wmiprvse.exe

Payload

Uses stealth techniques
Win32/EyeStye employs a user-mode rootkit that hooks the following low-levelAPIs to hide its malicious files, directory and registry data:

NtQueryDirectoryFile
NtVdmControl
NtEnumerateValueKey
NtSetInformationFile

Steals login credentials
When a user visits certain Internet banking sites and enters login credentials,Trojan:Win32/EyeStye.N captures the credentials using a technique known as "form grabbing". The trojan hooks several systemAPIs to capture login information, such as online banking credentials, web form data and keystrokes. Win32/EyeStye.N hooks the followingAPIs:

TranslateMessage
NtResumeThread
LdrLoadDll
InternetCloseHandle
HttpSendRequestA
HttpSendRequestW
PR_Write
send
CryptEncrypt
PFXImportCertStore
InternetQueryOptionA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpQueryInfoA
InternetReadFile
InternetQueryDataAvailable
InternetWriteFile
InternetReadFileExA 

By hooking the APIs mentioned above, the trojan can also inject malicious code into existing and new processes. This behavior assists the trojan to monitor the loading ofDLLs and manipulate the information sent and received through the Internet. The trojan attempts to send captured data viaHTTP POST to a remote server for collection by an attacker for financial gain. In the wild, we have observed this trojan connecting to one of the following remote servers:

• totdisseny.net
• burgermannnn7719.biz
• 188.72.201.213
• 195.88.191.44
• 212.150.164.200
• 213.155.31.136
• 46.166.131.160
• 46.4.73.27
• 74.50.98.160
• 80.91.191.228
• 95.168.178.220
• adbuleoncacc.info
• alunionylogen.ru
• analservice.eu
• aniani.info/cp
• bannedcellebs.biz
• bezdarniki.com
• californication.co.cc
• domonisteriosters.info
• frandiss.ru
• fullfreepoker.eu
• gallopusik.ru
• globallaty.ru
• gone4awalk.co.cc
• heartmusicjojo.co.cc
• host-checkker.net
• lenuki.ru/forum
• musictherealsouldx.ru
• nowtorrent.ru
• raz7pi7zop.com
• strflproject.com
• webawoke.com
• wefwef34.cz.cc
• eyesecurr657444.net
• youarelucky.ru

The trojan attempts to access login pages of popular websites such as "facebook.com" to capture the password of users of infected systems. While sending captured data, it may include the following other information:

• Bot guid - unique identifier associated with the trojan
• Trojan:Win32/EyeStye.N version
• User name and privilege
• Computer name
• Volume serial number
• Process name associated with captured data
• Name of hooked API function (for example PR_Write)
• Captured raw data
• Keys logged (keystrokes)
• Other information specific to computer locale such as:
  • Local time and t ime zone
  • Operating system language, version and service pack
  • Web browser(s) used and version

Lowers browser security
The trojan modifies registry data that lowers security settings in Internet Explorer Internet Zones and also allows the browser to accessdata sources across domains.

 

In the following subkeys:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4

Sets value: "1409"

To data: "3"

 

In the following subkeys:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4

Sets value: "1406"

To data: "0"

 

Trojan:Win32/Eystye.N disables the Phishing Filter in Internet Explorer by modifying registry data.

 

In subkey: HKCU\Software\Microsoft\Internet Explorer\PhishingFilter

Sets value: "EnabledV8"
With data: "0"

 

The trojan modifies other registry data to ensure that Internet Explorer launches in online mode.

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings

Adds value: "GlobalUserOffline"
With data: "0"

 

 

Deletes web browser history

The trojan deletes web browser history by modifying registry data to clear history when exiting Internet Explorer.

 

In subkey: HKCU\Software\Microsoft\Internet Explorer\Recovery

Adds value: "ClearBrowsingHistoryOnExit"
With data: "0"

 

Download updates and arbitrary files
Trojan:Win32/EyeStye.N attempts to connect to one of the servers previously mentioned and await commands from a remote attacker. Commands could include instructing the trojan to download arbitrary files that can include updates of the trojan. Successfully downloaded executable files are saved as the following and then run:

 

<Current directory>\<file name>.exe\<file name>upd.exe

 

Trojan:Win32/EyeStye.N may also update a configuration file stored in ZIP archive file format as the following:

 

<Current directory>\<file name>.exe\config.bin

 

The trojan communicates via a mutexes named "__<MUTEX NAME>_UNINSTALL__" and"__<MUTEX NAME>_RELOADCFG__" to instruct existing instances of malicious code in memory to "reload data", "uninstall", (and other actions) from the new configuration file. This allows the trojan and associated components access to a new remote server. 

 

Analysis by Tim Liu and Zarestel Ferrer