TSPY_GAMETHIEF.AR

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It steals CD keys, serial numbers, and/or the application product IDs of certain software. tolen information may be used for profit by cybercriminals who may gain access to the information.

It deletes itself after execution.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Information Theft

This spyware steals CD keys, serial numbers, and/or the application product IDs of certain software.

It gathers the following data:

• Host Name

Stolen Information

This spyware sends the gathered information via HTTP POST to the following URL:

• http://tools04.{BLOCKED}e.com/get.php?w={serial key}&h={host name}

Other Details

This spyware deletes itself after execution.

NOTES:

This spyware specifically targets the game Arma 2: Operation Arrowhead by Bohemia Interactive Studio.