TSPY_LOKI.UHBADDW

This Trojan Spy arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops copies of itself in the Windows Common Startup folder to enable its automatic execution at every system startup.

It gathers certain information on the affected computer.

It deletes the initially executed copy of itself.

Arrival Details

This Trojan Spy arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy drops the following files:

• %Application Data%\{6 random alphanumeric characters}\{6 random alphanumeric characters}.lck

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following copies of itself into the affected system:

• %Application Data%\{6 random alphanumeric characters}\{6 random alphanumeric characters}.exe
• %Application Data%\Microsoft\{Filename of malware}

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• {Hex values}

Autostart Technique

This Trojan Spy adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{Filename of malware} = %Application Data%\Microsoft\{Filename of malware}

It drops copies of itself in the Windows Common Startup folder to enable its automatic execution at every system startup.

Other System Modifications

This Trojan Spy adds the following registry keys:

HKEY_CURRENT_USER\http://{BLOCKED}ieght.com/work/zeya/gede/five/fre.php
{6 random alphanumeric characters} = %APPDATA%\{6 random alphanumeric characters}\{6 random alphanumeric characters}.exe

Information Theft

This Trojan Spy gathers the following information on the affected computer:

• User Name
• Computer Name

It attempts to steal stored account information used in the following installed File Transfer Protocol (FTP) clients or file manager software:

• 32BitFtp
• ALFTP
• BitKinex
• Bitvise
• BlazeFtp
• ClassicFTP
• Cyberduck
• EasyFTP
• ExpanDrive
• Far Manager
• FileZilla
• FlashFXP
• Fling
• FreshFTP
• FTPBox
• FTPGetter
• FTPInfo
• FTP Navigator
• FTP Now
• FTPShell
• fullsync
• DeluxeFTP
• GoFTP
• JaSFtp
• AbleFTP
• Automize
• LinasFTP
• MyFTP
• NetDrive
• Fastream NETFile
• NexusFile
• NovaFTP
• NppFTP
• Odin Secure FTP Expert
• KiTTY
• PuTTY
• SecureFX
• SftpNetDrive
• sherrod FTP
• SmartFTP
• Staff-FTP
• Steed
• SuperPutty
• Syncovery
• Total Commander
• UltraFXP
• WinFtp Client
• FSProtocol
• WinSCP
• Xftp

It gathers the following account information from any of the mentioned File Transfer Protocol (FTP) clients or file manager software:

• Username
• Password
• Port Number
• Terminal Type
• Server List

It attempts to steal stored email credentials from the following:

• Thunderbird
• Postbox
• FossaMail
• SeaMonkey
• Foxmail
• IncrediMail
• Microsoft Outlook

It attempts to get stored information such as user names, passwords, and hostnames from the following browsers:

• Comodo Dragon
• ChromePlus
• Google Chrome
• Nichome
• Rockmelt
• Spark
• Chromium
• Titan Browser
• Torch
• YandexBrowser
• Epic Privacy Browser
• Coc Coc
• Vivaldi
• Chromodo
• Superbird
• Coowon
• Mustang Browser
• 360Browser
• Citrio
• Orbitum
• Iridium
• Opera
• Sleipnir
• Internet Explorer
• Mozilla Firefox
• Flock
• K-Meleon
• IceDragon
• BlackHawk
• Cyberfox
• Pale Moon
• Lunascape
• SeaMonkey
• Waterfox
• QtWeb Internet Browser
• QupZilla
• Safari

Stolen Information

This Trojan Spy sends the gathered information via HTTP POST to the following URL:

• http://{BLOCKED}ieght.com/work/zeya/gede/five/fre.php
  As of this writing, the said site is inaccessible.

Other Details

This Trojan Spy deletes the initially executed copy of itself