TSPY_FUCOBHA.AD

This spyware executes a command to get detailed information on the installed network adapters. It executes a command to get a list of other computers in the same network as the infected machine.

This spyware does not have any propagation routine.

This spyware does not have any backdoor routine.

This spyware does not have any downloading capability.

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It gathers certain information on the affected computer.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following files:

• %Windows%\wdmaud.drv - also detected by Trend Micro as TSPY_FUCOBHA.AD
• {malware path}\photo19.png

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

Information Theft

This spyware gathers the following information on the affected computer:

• Computer's host name
• Current IP address
• Proxy server (if any)
• Current logged on user name
• System directory (%System%)
• Default code page
• Operating system version and service pack

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Stolen Information

This spyware sends the gathered information via HTTP POST to the following URL:

• http://www.{BLOCKED}nsw.net/jd2/upload.aspx?filepath=info&filename={computer name}_{current IP address}.jpg
• http://www.{BLOCKED}nsw.net/jd2/order/{computer name}_{current IP address}.jpg
• http://www.{BLOCKED}nsw.net/jd2/upload.aspx?filepath=ok&filename={computer name}_{current IP address}.jpg

NOTES:

Propagation

This spyware does not have any propagation routine.

Backdoor Routine

This spyware does not have any backdoor routine.

Rootkit Capabilities

This spyware does not have rootkit capabilities.

Download Routine

This spyware does not have any downloading capability.

Other Details

It executes the following command to get detailed information on the installed network adapters:

• ipconfig /all

It executes the following command to get a list of other computers in the same network as the infected machine:

• net view

It adds the gathered information to the above-mentioned list.

It opens the dropped file {malware path}\photo19.png to hide the malicious routines from the user.

This spyware does not exploit any vulnerability.