Trojan:Win32/Spyeye

Trojan:Win32/Spyeye is a trojan that captures keystrokes and steals login credentials through a method known as "form grabbing". Trojan:Win32/Spyeye sends captured data to a remote attacker, may download updates and has a rootkit component to hide its malicious activity.Installation

When run, this trojan makes the following registry modifications to ensure its copy executes at each system start:

In subkey: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Sets value: "<file name>.exe"
With data: "<current folder>\<file name>.exe"

If found, Trojan:Win32/Spyeye deletes old copies of itself from the affected computer.

It prevents detection by hooking certain APIs such as the following:

• NtQueryDirectoryFile
• NtVdmControl
• NtEnumerateValueKey

Payload

Steals information
Trojan:Win32/Spyeye attempts to gather the following information, which it then sends to a remote server:

• Bot GUID (a unique identifier associated with the malware)
• Current user name
• Computer name
• Volume serial number
• Process name associated with captured data
• Name of hooked API function (for example PR_Write)
• Keystrokes
• Other information specific to computer locale such as:
  
  • Local time
  • Time zone
  • Operating system version
  • Language

Downloads updates and arbitrary files
Trojan:Win32/Spyeye may download and run updates to itself or other files.

Analysis by Francis Allan Tan Seng