TSPY_FAREIT.UHBADBJ

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be downloaded by other malware/grayware from remote sites.

It connects to certain websites to send and receive information.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be downloaded by the following malware/grayware from remote sites:

• VBS_POWLOAD.NZU

Other System Modifications

This Trojan Spy adds the following registry entries:

HKEY_CURRENT_USER\Software\WinRAR
Client Hash = "{hex values}"

HKEY_CURRENT_USER\Software\WinRAR
HWID = "{hex values}"

Information Theft

This Trojan Spy attempts to steal stored account information used in the following installed File Transfer Protocol (FTP) clients or file manager software:

• 32BitFtp
• 3D-FTP
• AceBIT
• Adobe
• BitKinex
• Bullet Proof FTP
• CoffeeCup Software
• Core FTP
• Cryer WebSitePublisher
• Cyberduck
• DeluxeFTP
• EasyFTP
• Estsoft ALFTP
• ExpanDrive
• FTP Commander
• FTP Control
• FTP Explorer
• FTP Navigator
• FTP Now
• FTPGetter
• FTPRush
• FTPShell
• Far Manager
• FastTrackFTP
• FileZilla
• FireFTP
• FlashFXP 3
• FlashFXP 4
• FlashPeak BlazeFtp
• FreshFTP
• Frigate3
• GPSoftware Directory Opus
• Ghisler Total Commander
• Global Downloader
• GlobalSCAPE CuteFTP 6 Home
• GlobalSCAPE CuteFTP 6 Professional
• GlobalSCAPE CuteFTP 7 Home
• GlobalSCAPE CuteFTP 7 Professional
• GlobalSCAPE CuteFTP 8 Home
• GlobalSCAPE CuteFTP 8 Professional
• GlobalSCAPE CuteFTP 9
• GlobalSCAPE CuteFTP Lite
• GlobalSCAPE CuteFTP Pro
• GoFTP
• INSoftware NovaFTP
• Ipswitch WS_FTP
• LeapWare LeapFTP
• LeechFTP
• LinasFTP
• MAS-Soft FTPInfo
• MS IE FTP
• Martin Prikryl
• My FTP
• NCH Software ClassicFTP
• NCH Software Fling
• NetDrive
• NetSarang
• NexusFile
• Nico Mak Computing WinZip
• Notepad++ NppFTP
• Opera
• RhinoSoft FTPVoyager
• Robo-FTP 3.7
• SimonTatham PuTTY
• SmartFTP
• SoftX FTP Client
• Sota FFFTP
• South River Technologies WebDrive
• Staff-FTP
• TurboFTP
• UltraFXP
• VanDyke SecureFX
• Visicom Media
• WinFTP
• SFTP

It gathers the following account information from any of the mentioned File Transfer Protocol (FTP) clients or file manager software:

• Username
• Password
• User ID
• Host Address
• Directory List
• Port Number
• Terminal Type
• Server Name
• Server Type

It attempts to steal stored email credentials from the following:

• IncrediMail
• Microsoft Outlook
• Microsoft Windows Live Mail
• Microsoft Windows Mail
• Poco Systems Pocomail
• RIT The Bat!
• Thunderbird

It attempts to get stored information such as user names, passwords, and hostnames from the following browsers:

• Bromium
• Chromium
• Comodo
• Epic
• FastStone Browser
• Flock
• Google Chrome
• K-Meleon
• MapleStudio ChromePlus
• Mozilla Firefox
• Mozilla SeaMonkey
• Nichrome
• Opera
• RockMelt
• Yandex
• Internet Explorer

It uses the following list of user names and passwords to access password-protected locations where the mentioned information is stored:

• 000000
• 11111
• 111111
• 11111111
• 112233
• 123123
• 123321
• 12345
• 123456
• 1234567
• 12345678
• 123456789
• 1234567890
• 123abc
• 123qwe
• 1q2w3e
• 1q2w3e4r
• 222222
• 55555
• 654321
• 666666
• 7777777
• aaaaaa
• abc123
• adidas
• admin
• amanda
• andrew
• angel
• angel1
• angels
• anthony
• apple
• asdfasdf
• asdfgh
• ashley
• asshole
• austin
• bailey
• banana
• bandit
• baseball
• batman
• benjamin
• billgates
• biteme
• blabla
• blahblah
• blessed
• blessing
• blink182
• bubbles
• buster
• canada
• cassie
• charlie
• cheese
• chelsea
• chicken
• chris
• christ
• church
• cocacola
• compaq
• computer
• cookie
• corvette
• creative
• dakota
• dallas
• daniel
• danielle
• david
• destiny
• dexter
• diamond
• digital
• dragon
• eminem
• emmanuel
• enter
• faith
• flower
• foobar
• football
• football1
• forever
• forum
• freedom
• friend
• friends
• fuckoff
• fuckyou
• fuckyou1
• gates
• gateway
• genesis
• george
• gfhjkm
• ghbdtn
• ginger
• google
• grace
• green
• guitar
• hahaha
• hallo
• hannah
• happy
• hardcore
• harley
• heaven
• hello
• hello1
• helpme
• hockey
• hotdog
• hunter
• ilovegod
• iloveyou
• iloveyou!
• iloveyou1
• iloveyou2
• internet
• james
• jasmine
• jason
• jasper
• jennifer
• jessica
• jesus
• jesus1
• john316
• jordan
• jordan23
• joseph
• joshua
• junior
• justin
• killer
• kitten
• knight
• letmein
• london
• looking
• lovely
• loving
• lucky
• maggie
• master
• matrix
• matthew
• maverick
• maxwell
• merlin
• michael
• michelle
• mickey
• microsoft
• monkey
• mother
• muffin
• mustang
• mustdie
• mylove
• myspace1
• nathan
• nicole
• nintendo
• nothing
• onelove
• online
• orange
• passw0rd
• password
• password1
• peace
• peaches
• peanut
• pepper
• phpbb
• pokemon
• power
• praise
• prayer
• prince
• princess
• purple
• qazwsx
• qwert
• qwerty
• qwerty1
• rachel
• rainbow
• red123
• richard
• robert
• rotimi
• samantha
• sammy
• samuel
• saved
• scooby
• scooter
• secret
• shadow
• shalom
• silver
• single
• slayer
• smokey
• snoopy
• soccer
• soccer1
• sparky
• spirit
• startrek
• starwars
• stella
• summer
• sunshine
• superman
• taylor
• testing
• testtest
• thomas
• thunder
• tigger
• trinity
• trustno1
• victory
• viper
• welcome
• whatever
• william
• windows
• winner
• wisdom
• zxcvbnm

Other Details

This Trojan Spy connects to the following website to send and receive information:

• http://{BLOCKED}an.com/blog/zecopanelnew/gate.php

It does the following:

• It may also possess the capability to steal information from various cryptocurrency wallets. It searches and attempts to extract information from the following files:
  • .wallet (Armory)
  • .wallet (MultiBit)
  • electrum.dat (Electrum)
  • wallet.dat (Anoncoin)
  • wallet.dat (BBQcoin)
  • wallet.dat (Bitcoin)
  • wallet.dat (Bytecoin)
  • wallet.dat (Craftcoin)
  • wallet.dat (Devcoin)
  • wallet.dat (Digitalcoin)
  • wallet.dat (Fastcoin)
  • wallet.dat (Feathercoin)
  • wallet.dat (Florincoin)
  • wallet.dat (Franko)
  • wallet.dat (Freicoin)
  • wallet.dat (GoldCoin (GLD))
  • wallet.dat (I0coin)
  • wallet.dat (Infinitecoin)
  • wallet.dat (Ixcoin)
  • wallet.dat (Junkcoin)
  • wallet.dat (Litecoin)
  • wallet.dat (Luckycoin)
  • wallet.dat (Megacoin)
  • wallet.dat (Mincoin)
  • wallet.dat (Namecoin)
  • wallet.dat (NovaCoin)
  • wallet.dat (Phoenixcoin)
  • wallet.dat (PPCoin)
  • wallet.dat (Primecoin)
  • wallet.dat (ProtoShares)
  • wallet.dat (Quarkcoin)
  • wallet.dat (Tagcoin)
  • wallet.dat (Terracoin)
  • wallet.dat (Worldcoin)
  • wallet.dat (Yacoin)
  • wallet.dat (Zetacoin)