TSPY_POSDAN.A

This spyware may arrive bundled with malware packages as a malware component. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It is capable of encrypting files in the affected system.

Arrival Details

This spyware may arrive bundled with malware packages as a malware component.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following copies of itself into the affected system:

• If "--setup {value}" parameter is used:
  %Application Data%\Microsoft\Windows Services\{malware name}

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Information Theft

This spyware accepts the following parameters:

• --disp
• --setup {value}
• --exec {value}
• --wait {value}

Other Details

This spyware does the following:

• It elevates its system privileges using process explorer.exe or winlogon.exe
• If "--exec {value}" parameter is used:
  It encrypts files except when it contains the following strings found in its full path name:
  
  • *.dll
  • *.inf
  • *.msu
  • *.msi
  • ntuser.*
  • *.scr
  • *.exe
  • boot.ini
  • ntldr
  • *.ocx
  • System Volume Information
  • Windows
  • Boot
  • *msdtssrvr*
  • *firefox*
  • *thunderbird*
  • *store*
  • *fdlauncher*
  • *outlook*
  • *chrome*
  • *exfba*
  • *ReportingServicesService*
  • *inet*
  • *iis*
  • *exchange*
  • *sql*
  • *mad*
  • Microsoft\Exchange Server
  • Microsoft SQL Server
  
  Where * - any string of zero or more characters
• If "--disp" parameter is used:
  
  • disables mouse input
  • disables keyboard input
  • displays the following image:
  
  

It is capable of encrypting files in the affected system.