PWSteal.Refest does the following when it is executed:
1. Creates a dll file in the %System% directory. This file has a random name with up to 8 lower-case characters, e.g., "abcde.dll" or "qrstuvwx.dll". The file is 45056 bytes in length.
Note: %System% is a variable. The Trojan locates the System folder and creates a dll in that location. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
2. Installs the dll as a Browser Helper Object, so that it is loaded every time Internet Explorer starts. To do this, it creates the following registry keys:
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{<random clsid>}
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{<random clsid>}
and sets the value
(Default) = %System%\<random name>.dll
in the registry key
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{<random clsid>}\InProcServer32.
The {<random clsid>} is a random value of the form, {########-####-####-####-############}, for example, {380b99b4-5f7d-7791-b8ef-499d848499e6}.
3. The dll monitors outgoing https connections to the following websites:
o .anz.com
o .bendigobank.com.au
o .citibank.com
o .citibank.de
o .commbank.com.au
o .dab-bank.com
o .deutsche-bank.de
o .e-gold.com
o .hsbc.com.au
o .hsbc.com.hk
o .online-banking.standardchartered.com.hk
o .sparkasse-banking.de
o .stgeorge.com.au
o banking.lbbw.de
o banking.mashreqbank.com
o banknetpower.net
o barclays.co.uk
o cd.citibank.co.ae
o cibconline.cibc.com
o citibank.com.au
o dit-online.de
o easyweb.tdcanadatrust.com
o ebank.uae.hsbc.com
o ekocbank.kocbank.com.tr
o hercules.pamukbank.com.tr
o internetsube.akbank.com.tr
o lloydstsb.co.uk
o national.com.au
o nbd.ae
o online-banking.standardchartered.ae
o online.nbad.com
o pbg1.edc.citiaccess.com
o standardchartered.com
o suncorpmetway.com.au
o westpac.com.au
o
www.alahlionline.com
o
www.almubasher.com.sa
o
www.arabi-online.com
o
www.cbdonline.ae
o
www.citibank.com.hk
o
www.dahsing.com
o
www.ebank.iba.com.hk
o
www.privatebank.citibank.com.sg
o
www.sabbnet.com
o
www.samba.com
o
www.scotiaonline.scotiabank.com
o
www.unb.com
o www1.bmo.com
o www1.royalbank.com
4. When Internet Explorer makes an HTTP POST request to one of these domains (for example, when the user submits a web form at a bank site), the Trojan also sends the information to a cgi script at
www.refestltd.com.