TROJANSPY.WIN32.TEAMFOSTEALER.THOABAAI

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain websites to send and receive information.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy drops the following files:

• %User Temp%\PmIgYzA\FZhIG.ico
• %User Temp%\PmIgYzA\config.bin
• %User Temp%\PmIgYzA\0.0
• %User Temp%\PmIgYzA\TV.dll (malicious payload)
• %User Startup%\Gateway Layer 1.3957.lnk (shortcut link to dropped TeamViewer.exe)

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.. %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows XP, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, and 8.)

It drops the following non-malicious files:

• %User Temp%\PmIgYzA\TeamViewer.exe
• %User Temp%\PmIgYzA\TeamViewer_Resource_fr.dll

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

It creates the following folders:

• %User Temp%\PmIgYzA

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

Information Theft

This Trojan Spy gathers the following data:

• Operating System
• OS Architecture
• Computer Name
• User Name
• RAM size
• Presence of AV Products
• Administrator Privilege

Other Details

This Trojan Spy connects to the following website to send and receive information:

• http://{BLOCKED}s32.com/3307

It does the following:

• It executes the EXE file %User Temp%\PmIgYzA\TeamViewer.exe which loads the malicious DLL %User Temp%\PmIgYzA\TV.dll

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)