TSPY_EUPUDS.AW

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It retrieves specific information from the affected system.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following copies of itself into the affected system:

• %Application Data%\{random folder name}\{random malware name}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It creates the following folders:

• %Application Data%\{random folder name}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• DynGateInstanceMutexS

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random malware name} = "%Application Data%\{random folder name}\{random malware name}.exe"

Download Routine

This spyware connects to the following URL(s) to download its configuration file:

• http://{BLOCKED}.{BLOCKED}.30.5/mfb.php
• http://{BLOCKED}.{BLOCKED}.30.4/mfb.php

Information Theft

This spyware retrieves the following information from the affected system:

• User ID
• Browsers & Version
• OS Type & Version
• Malware Version

It attempts to get stored information such as user names, passwords, and hostnames from the following browsers:

• iexplore.exe
• firefox.exe
• chrome.exe

Stolen Information

This spyware sends the gathered information via HTTP POST to the following URL:

• http://{BLOCKED}.{BLOCKED}.30.4/index.php
• http://{BLOCKED}.{BLOCKED}.30.5/index.php

NOTES:

It injects its code to running processes except processes with the following names:

• services.exe
• explorer.exe
• userinit.exe
• System Idle Process
• System
• Interrupts
• csrss.exe
• svchost.exe
• winlogon.exe
• lsass.exe
• iexplore.exe
• firefox.exe
• chrome.exe

It hooks ExitProcess API with an infinite sleep command to avoid unloading of memory functions.

It may collect information when the following sites are accessed:

• login.live.com/ppsecure
• www.facebook.com/login.php
• live.com
• facebook.com
• hotmail.com