TSPY_FAREIT.ABU

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following files:

• %User Temp%\{random characters}.bat

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following processes:

• cmd.exe (uses the dropped .bat file)

Other System Modifications

This spyware adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\WinRAR
HWID = "{GUID}"

HKEY_CURRENT_USER\Software\WinRAR
Client Hash = "{Random Value}"

Information Theft

This spyware attempts to steal stored account information used in the following installed File Transfer Protocol (FTP) clients or file manager software:

• GlobalSCAPE CuteFTP 6 Home
• GlobalSCAPE CuteFTP 6 Professional
• GlobalSCAPE CuteFTP 7 Home
• GlobalSCAPE CuteFTP 7 Professional
• GlobalSCAPE CuteFTP 8 Home
• GlobalSCAPE CuteFTP 8 Professional
• GlobalSCAPE CuteFTP 9
• GlobalSCAPE CuteFTP Lite
• GlobalSCAPE CuteFTP Pro
• Nico Mak Computing WinZip FTP
• 3D-FTP
• ALFTP
• AceBIT
• BitKinex
• BlazeFtp
• Bullet Proof FTP
• ClassicFTP
• CoffeeCup
• CoreFTP
• CuteFTP
• Cyberduck
• EasyFTP
• ExpanDrive
• FFFTP
• FTP
• FTP Explorer
• FTPClient
• FTPNow
• FTPRush
• FTPShell
• FTPVoyager
• Far
• Far2
• FileZilla
• FlashFXP
• Fling
• Frigate3
• Ghisler
• LeapFTP
• LeechFTP
• LinasFTP
• NetDrive
• NetSarang
• NovaFTP
• PuTTY
• Robo-FTP
• SeaMonkey
• SecureFX
• SmartFTP
• Staff-FTP
• TurboFTP
• WS_FTP
• WebDrive
• WinFTP
• WinZip
• FTP++
• FTPCON
• FTPGetter
• FTPNow
• FTPRush
• FTPShell
• FTPWare COREFTP
• Ghisler Total Commander
• Ghisler Windows Commander

It gathers the following account information from any of the mentioned File Transfer Protocol (FTP) clients or file manager software:

• Directory list
• Password
• Port Number
• Server Name
• Server Type
• User Name

It attempts to steal stored email credentials from the following:

• BatMail
• IncrediMail
• Outlook
• Pocomail
• Thunderbird
• Windows Live Mail
• Windows Mail

It attempts to get stored information such as user names, passwords, and hostnames from the following browsers:

• Chrome
• ChromePlus
• Chromium
• FastStone Browser
• Flock
• Internet Explorer
• K-Meleon
• Mozilla Firefox
• Opera Browser

It uses the following list of user names and passwords to access password-protected locations where the mentioned information is stored:

• billgates
• ghbdtn
• gfhjkm
• password
• phpbb
• qwerty
• jesus
• abc123
• letmein
• test
• love
• password1
• hello
• monkey
• dragon
• trustno1
• iloveyou
• shadow
• christ
• sunshine
• master
• computer
• princess
• tigger
• football
• angel
• jesus1
• whatever
• freedom
• killer
• asdf
• soccer
• superman
• michael
• cheese
• internet
• joshua
• fuckyou
• blessed
• baseball
• starwars
• purple
• jordan
• faith
• summer
• ashley
• buster
• heaven
• pepper
• hunter
• lovely
• andrew
• thomas
• angels
• charlie
• daniel
• jennifer
• single
• hannah
• qazwsx
• happy
• matrix
• pass
• aaaaaa
• amanda
• nothing
• ginger
• mother
• snoopy
• jessica
• welcome
• pokemon
• iloveyou1
• mustang
• helpme
• justin
• jasmine
• orange
• testing
• apple
• michelle
• peace
• secret
• grace
• william
• iloveyou2
• nicole
• muffin
• gateway
• fuckyou1
• asshole
• hahaha
• poop
• blessing
• blahblah
• myspace1
• matthew
• canada
• silver
• robert
• forever
• asdfgh
• rachel
• rainbow
• guitar
• peanut
• batman
• cookie
• bailey
• soccer1
• mickey
• biteme
• hello1
• eminem
• dakota
• samantha
• compaq
• diamond
• taylor
• forum
• john316
• richard
• blink182
• peaches
• cool
• flower
• scooter
• banana
• james
• asdfasdf
• victory
• london
• 123qwe
• startrek
• george
• winner
• maggie
• trinity
• online
• 123abc
• chicken
• junior
• chris
• passw0rd
• austin
• sparky
• admin
• merlin
• google
• friends
• hope
• shalom
• nintendo
• looking
• harley
• smokey
• joseph
• lucky
• digital
• thunder
• spirit
• bandit
• enter
• anthony
• corvette
• hockey
• power
• benjamin
• iloveyou!
• 1q2w3e
• viper
• genesis
• knight
• qwerty1
• creative
• foobar
• adidas
• rotimi
• slayer
• wisdom
• praise
• zxcvbnm
• samuel
• mike
• dallas
• green
• testtest
• maverick
• onelove
• david
• mylove
• church
• friend
• god
• destiny
• none
• microsoft
• bubbles
• cocacola
• jordan23
• ilovegod
• football1
• loving
• nathan
• emmanuel
• scooby
• fuckoff
• sammy
• maxwell
• jason
• john
• 1q2w3e4r
• baby
• red123
• blabla
• prince
• qwert
• chelsea
• angel1
• hardcore
• dexter
• saved
• hallo
• jasper
• danielle
• kitten
• cassie
• stella
• prayer
• hotdog
• windows
• mustdie
• gates

Stolen Information

This spyware sends the gathered information via HTTP POST to the following URL:

• http://{BLOCKED}sxlux.us/30/gate.php