TSPY_FAREIT.MIR

This spyware may be dropped by other malware.

It executes then deletes itself afterward.

It does not have any propagation routine.

It does not have any backdoor routine.

Arrival Details

This spyware may be dropped by the following malware:

• JS_BLACKOLE.MIR

Installation

This spyware executes then deletes itself afterward.

Other System Modifications

This spyware adds the following registry entries:

HKEY_CURRENT_USER\Software\WinRAR
HWID = "{random value}"

HKEY_CURRENT_USER\Software\WinRAR
Client Hash = "{random value}"

HKEY_CURRENT_USER\Software\WinRAR
{random characters} = "{random value}"

Propagation

This spyware does not have any propagation routine.

Backdoor Routine

This spyware does not have any backdoor routine.

Download Routine

This spyware connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}n-node.com/6.exe
• http://{BLOCEKD}n-node.com/1.exe?c=1

It saves the files it downloads using the following names:

• %User Temp%\{random numbers}.exe - detected as TROJ_FAKEAV.MIR

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Stolen Information

This spyware sends the gathered information via HTTP POST to the following URL:

• http://{BLOCKED}apis.com/gate.php
• http://{BLOCKED}n-node.com/gate.php
• http://{BLOCKED}ic-a.akamaihd.net/gate.php
• http://l.{BLOCKED}g.com/gate.php
• http://{BLOCKED}-cdn-node.com/gate.php
• http://{BLOCKED}1.{BLOCKED}b.{BLOCKED}s.com/gate.php
• http://{BLOCKED}3.{BLOCKED}r.ovi.com/gate.php

NOTES:

It attempts to steal stored account information of the following installed FTP clients or File Managers:

• 32BitFtp
• 3D-FTP
• AceFTP
• BPFTP
• BlazeFtp
• BulletProof FTP Client
• Coffee Cup Free FTP
• DeluxeFTP
• EasyFTP
• Estsoft
• FFFTP (Sota)
• FTP CONTROL
• FTP Commander
• FTP Explorer
• FTP Navigator
• FTP Now
• FTP++
• FTPCON
• FTPClient
• FTPGetter
• FTPRush
• FTPShell
• FTPVoyager
• FTPWare
• Far Manager
• FileZilla
• FreshFTP
• Ftp Winzip (Nico Mak Computing)
• Ghisler
• GlobalSCAPE CuteFTP 6 Home
• GlobalSCAPE CuteFTP 6 Professional
• GlobalSCAPE CuteFTP 7 Home
• GlobalSCAPE CuteFTP 7 Professional
• GlobalSCAPE CuteFTP 8 Home
• GlobalSCAPE CuteFTP 8 Professional
• GoFTP
• Ipswitch WS_FTP
• LeapWare LeapFTP
• LeechFTP
• LinasFTP
• MAS-Soft FTPInfo
• MS IE FTP Passwords
• NCH Software ClassicFTP
• NovaFTP
• PuTTY
• Robo-FTP 3.7
• SmartFTP
• SoftX.org FTPClient
• Staff-FTP
• TurboFTP
• WS_FTP
• WinFTP
• salt-ftp

It gathers the following account information from any of the aforementioned FTP clients or File Managers:

• Password
• Port Number
• Server Name
• Server Type
• User Name
• Directory list

It also attempts to steal stored email credentials:

• BatMail
• IncrediMail
• Outlook
• Pocomail
• Thunderbird
• Windows Live Mail
• Windows Mail

This spyware attempts to retrieve stored information such as user names, passwords, and hostnames from the following browsers:

• FastStone Browser
• Flock Browser
• Google Chrome
• Internet Explorer
• K-Meleon
• Mozilla Firefox
• Opera Browser
• RockMelt

This spyware uses the following list of user names and passwords to access password-protected locations where the aforementioned information are stored:

• 123abc
• 123qwe
• 1q2w3e
• 1q2w3e4r
• aaaaaa
• abc123
• adidas
• admin
• amanda
• andrew
• angel
• angel1
• angels
• anthony
• apple
• asdf
• asdfasdf
• asdfgh
• ashley
• asshole
• austin
• baby
• bailey
• banana
• bandit
• baseball
• batman
• benjamin
• billgates
• biteme
• blabla
• blahblah
• blessed
• blessing
• blink182
• bubbles
• buster
• canada
• cassie
• charlie
• cheese
• chelsea
• chicken
• chris
• christ
• church
• cocacola
• compaq
• computer
• cookie
• cool
• corvette
• creative
• cryptimplus
• dakota
• dallas
• daniel
• danielle
• david
• destiny
• dexter
• diamond
• digital
• dragon
• eminem
• emmanuel
• enter
• faith
• flower
• foobar
• football
• football1
• forever
• forum
• freedom
• friend
• friends
• fuckoff
• fuckyou
• fuckyou1
• gates
• gateway
• genesis
• george
• gfhjkm
• ghbdtn
• ginger
• god
• google
• grace
• green
• guitar
• hahaha
• hallo
• hannah
• happy
• hardcore
• harley
• heaven
• hello
• hello1
• helpme
• hockey
• hope
• hotdog
• hunter
• ilovegod
• iloveyou
• iloveyou!
• iloveyou1
• iloveyou2
• internet
• james
• jasmine
• jason
• jasper
• jennifer
• jessica
• jesus
• jesus1
• john
• john316
• jordan
• jordan23
• joseph
• joshua
• junior
• justin
• killer
• kitten
• knight
• letmein
• london
• looking
• love
• lovely
• loving
• lucky
• maggie
• master
• matrix
• matthew
• maverick
• maxwell
• merlin
• michael
• michelle
• mickey
• microsoft
• mike
• monkey
• mother
• muffin
• mustang
• mustdie
• mylove
• myspace1
• nathan
• nicole
• nintendo
• none
• nothing
• onelove
• online
• orange
• pass
• passw0rd
• password
• password1
• peace
• peaches
• peanut
• pepper
• phpbb
• pokemon
• poop
• power
• praise
• prayer
• prince
• princess
• purple
• qazwsx
• qwert
• qwerty
• qwerty1
• rachel
• rainbow
• red123
• richard
• robert
• rotimi
• samantha
• sammy
• samuel
• saved
• scooby
• scooter
• secret
• shadow
• shalom
• silver
• single
• slayer
• smokey
• snoopy
• soccer
• soccer1
• sparky
• spirit
• startrek
• starwars
• stella
• summer
• sunshine
• superman
• taylor
• test
• testing
• testtest
• thomas
• thunder
• tigger
• trinity
• trustno1
• victory
• viper
• welcome
• whatever
• william
• windows
• winner
• wisdom
• zxcvbnm