TSPY_LIMITA.F

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following files:

• %Application Data%\010112.txt
• %Application Data%\Sample.lnk
• %User Temp%\logff.txt
• %User Temp%\logmail.txt

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It drops the following copies of itself into the affected system:

• %Application Data%\FBMPe\{Malware Name}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It creates the following folders:

• %Application Data%\FBMPe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
sidebar = "%Application Data%\Sample.lnk"

Other System Modifications

This spyware adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\{Malware Name}_RASAPI32

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\{Malware Name}_RASMANCS

Information Theft

This spyware gathers the following data:

• Browser Cache Usernames/Password (Chrome, IE,Safari,Opera)
• Internet Download Manager Credentials
• Smart FTP & Core FTP Credentials
• Computer Information (Computer Name, Diskspace, OS version/platform, Firewall Installed, AV Installed)
• Clipboard Data (w/ Window Title)
• Keystroke (w/ Window Title)

Stolen Information

This spyware sends the data it gathers to the following email addresses via SMTP:

• mail.{BLOCKED}e.com.de

Other Details

This spyware connects to the following URL(s) to get the affected system's IP address:

• {BLOCKED}p.ru/en-EN/index.php