1. Symantec-Broadcom-Horizontal/
  2. Security Response/
  3. Attack Signatures/
  4. System Infected: Infostealer.Shiz Activity

System Infected: Infostealer.Shiz Activity

Severity: High

This attack could pose a serious security threat. You should take immediate action to stop any damage or prevent further damage from happening.

Description

This signature detects traffic generated by Infostealer.Shiz which could lead to futher infection of the affected system.

Additional Information

When the Trojan is executed, it copies itself as the following file:
%Windir%\AppPatch\[RANDOM FILE NAME]

Note: [RANDOM FILE NAME] may be one of the following file names and file extensions:
ijntbx.exe
oupcckm.exe
smnoft.dat
hagveo.dat
fvvkpp.dat
sgacpck.dat
nobiya.exe
fmuqwvc.dat
tpfirc.exe
sjnaaws.exe

It then modifies the following registry entry so that it runs every time Windows starts:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"Userinit" =
"%System%\userinit.exe, %Windir%\AppPatch\[RANDOM FILE NAME]"

It also creates the following registry entry so that it runs every time Windows starts:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"[RANDOM NUMBERS]" = "%Windir%\AppPatch\[RANDOM FILE NAME]"

It then creates the following registry subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\[RANDOM NUMBERS]

Note: [RANDOM NUMBERS] may be one of the following sets of numbers:
68aa6c1d
68aa6c8ba

Next, the threat checks for various processes, including the following:
ollydbg
wireshark
idaq
dumpcap
vmwaretray

It also checks for files, user names, or paths related to virtual machines or test environments.

The threat will block connections to URLs containing the following strings:
avast.com
kaspersky
drweb
eset.com
antivir
avira
virustotal
virusinfo
z-oleg.com
kltest.org.ru
trendsecure
anti-malware
comodo.com

The Trojan then searches for system processes to inject it's malicious payload into. Once it has injected the payload into the system process, it will inject all processes on the compromised computer in order to find passwords and cryptographic certificates.

It attempts to steal information related to the following services:
Inist Co
IBANK
InterBank
Marfin Laiki Bank
Qiwi.ru
Yota

It gathers the information by reading the memory of the processes, accessing the clipboard, and using keylogging applications. It also steals cryptographic credentials from the user.

The Trojan then contacts the following domain to receive commands:
[http://]vopycoc.com

The commands allow the Trojan to create new files and processes on the compromised computer and/or to inject malicious payloads into processes.

Affected

  • Windows
  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube