TSPY_LIMITAIL.TH

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following file(s)/component(s):

• %User Profile%\rw24y4j3b4\23405.vbs
• %User Profile%\rw24y4j3b4\50298.cmd
• %User Profile%\rw24y4j3b4\CQKnmIrQlweL.QNI
• %User Profile%\rw24y4j3b4\run.vbs
• %User Profile%\rw24y4j3b4\SAPWrwPKKweA.MHU
• %User Profile%\rw24y4j3b4\SeZPJx.UYA
• %User Temp%\dw.log
• %User Temp%\logoff.txt

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It drops and executes the following files:

• %User Profile%\rw24y4j3b4\update.exe - non-malicious

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It creates the following folders:

• %User Profile%\rw24y4j3b4
• %Application Data%\Microsoft\Backups

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It stays resident in memory by creating the following process(es):

• RegSvcs.exe

It injects codes into the following process(es):

• created RegSvcs.exe

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
rw24y4j3b4 = "%User Profile%\rw24y4j3b4\23405.vbs"

It drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\RegSvcs.exe

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

Information Theft

This spyware gathers the following data:

• Browser Cache Usernames/Password (Chrome, IE,Safari,Opera)
• Internet Download Manager Credentials
• Smart FTP & Core FTP Credentials
• Computer Information (Computer Name, IP Address, Diskspace, OS version/platform, Firewall Installed, AV Installed)
• Clipboard Data (w/ Window Title)
• Keystroke (w/ Window Title)

Stolen Information

This spyware sends the data it gathers to the following email addresses via SMTP:

• {BLOCKED}ards@{BLOCKED}dimex.cl

Other Details

This spyware connects to the following URL(s) to get the affected system's IP address:

• http://www.{BLOCKED}.ru/en-EN/index.php