TSPY_URELAS.A

This spyware monitors and captures screenshots of specific games. It sends the stolen information its C&C server. This may lead to exposure of gaming credentials.

To get a one-glance comprehensive view of the behavior of this Spyware, refer to the Threat Diagram shown below.

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes the initially executed copy of itself.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following copies of itself into the affected system and executes them:

• %User Temp%\{malware file name}.exe
• %User Temp%\{malware file name}_test.tgs

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It drops the following file(s)/component(s):

• {Malware Path}\$$Windows$$.bat - used to delete the initially executed malware copy. This is also deleted after execution

It uses the following names for the copies it drops:

• svchost
• svcsg
• smse
• service
• lssas
• comine
• explorer
• spoolvs
• ctfmom
• taskmgr
• algs
• system

Information Theft

This spyware gathers the following data:

• Game screenshots
• Operating system version
• Computer name

Other Details

This spyware deletes the initially executed copy of itself

NOTES:

This spyware captures screenshots by monitoring the following game-related processes:

• Baduki.exe
• DuelPoker.exe
• FNF.exe
• highlow2.exe
• HOOLA3.EXE
• LASPOKER.exe
• poker7.exe
• RealBaduki.exe

It sends the information it gathers to the following remote sites:

• {BLOCKED}r.{BLOCKED}e2012.com