TrojanDownloader:Win32/Spycos.R is malware that downloads and executes other malware from a remote server. It also terminates security processes and services, as well as steals information about your computer.
Installation
TrojanDownloader:Win32/Spycos.R copies itself to the Temporary Files folder as a CPL file with a random 12-digit file name.
It creates the following registry entry so that this file automatically runs every time Windows starts:
In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "<14 random numbers>"
With data: "%Temp%\<malware file name>"
It also drops the following clean files as part of its installation routine:
- %Temp%\_thundbs2.db
- %Temp%\FXSAPIDebuglog.DLL
Payload
Terminates antivirus processes and services
TrojanDownloader:Win32/Spycos.R terminates the following antivirus processes and services, if they exist in your computer:
Processes:
- avgam.exe
- avgchsvx.exe
- avgfws9.exe
- AVGIDSAgent.exe
- AVGIDSMonitor.exe
- avgnsx.exe
- avgrsx.exe
- avgsrvx.exe
- avgwdsvc.exe
Services:
- aswUpdSv
- avast! Mail Scanner
- avast! Web Scanner
- AVGWD
It also disables Least User Access (LUA).
Removes security-related Browser Helper Objects (BHO)
TrojanDownloader:Win32/Spycos.R removes the following Browser Helper Objects (BHO) if they are found in your computer; these objects refer to security toolbars for AVG:
- HKLM\Software\Micrososft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
- HKLM\Software\Micrososft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}
- HKLM\Software\Micrososft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
Steals information about your computer
TrojanDownloader:Win32/Spycos.R steals the following information about your computer:
- Online banking plugins installed in your computer
- Antivirus products installed in your computer
- Windows version of your computer
- Computer name
- Volume serial number of your hard disk
- Current user name
It sends the information to the server "entreterimentoglass.com".
Downloads and installs additional malware
TrojanDownloader:Win32/Spycos.R can download other malware by connecting to remote servers, usually via HTTP. It is known to download files from the following sites:
- aviramento32.kit.net
- chicabana21.kit.net
It downloads files only when the default language in your computer is Portuguese.
Analysis by Alden Pornasdoro
