TSPY_USTEAL.USRJ

This USTEAL variant drops a ransomware detected as TROJ_RANSOM.SMAR, which is created by a new toolkit builder.

To get a one-glance comprehensive view of the behavior of this Spyware, refer to the Threat Diagram shown below.

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware adds the following folders:

• {Malware Path}\ufr_reports

It drops and executes the following files:

• %User Temp%\222.exe - detected as TROJ_RANSOM.SMAR

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• UFR3

Information Theft

This spyware gathers the following data:

• System Information

Stolen Information

This spyware saves the stolen information in the following file:

• {Malware Path}\ufr_reports\report_{dd-mm-yyyy}_{System IDs}-{random}.bin

Drop Points

Stolen information is uploaded to the following websites:

• {BLOCKED}.{BLOCKED}i.esy.es

Other Details

This spyware connects to the following URL(s) to get the affected system's IP address:

• http://whatismyip.akamai.com
• http://whatismyip.everdot.org/ip
• http://whatismyip.org

NOTES:

It attempts to steal stored account information of the following installed FTP clients or File Managers:

• WS_FTP
• SmartFTP
• CoreFTP
• FileZilla
• FlashFXP
• Far
• Total Commander
• WinSCP

It also attempts to steal stored email credentials:

• The Bat!
• IncrediMail
• SeaMonkey
• Thunderbird

This spyware attempts to retrieve stored information such as user names, passwords, and hostnames from the following browsers:

• Internet Explorer
• Opera
• Chromium-based
• FireFox
• Safari

This spyware attempts to retrieve stored information such as user names and passwords from the following instant messenger:

• Mail.Ru Agent
• ICQ
• Miranda
• Psi
• Google Talk
• QIP 2005
• Live Messenger
• Pidgin
• QIP Infium
• MSN Messenger

This spyware attempts to retrieve stored information such as user names and passwords from the following games:

• World Of Tanks
• Full Tilt Poker
• Poker Stars

This spyware attempts to retrieve stored information such as user names and passwords from the following Windows applications:

• RDP
• Windows RAS