TSPY_FAREIT.YYSUT

This spyware may be downloaded by other malware/grayware from remote sites.

It uses certain lists of user names and passwords to access password-protected shared files.

It connects to certain websites to send and receive information. It deletes the initially executed copy of itself.

Arrival Details

This spyware may be downloaded by the following malware/grayware from remote sites:

• PDF_FAREIT.BYX
• PDF_FAREIT.AK

Installation

This spyware drops the following files:

• %User Temp%\{random}.bat - deleted after execution

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other System Modifications

This spyware also creates the following registry entry(ies) as part of its installation routine:

HKEY_CURRENT_USER\Software\WinRAR
HWID = "{hex values}"

HKEY_CURRENT_USER\Software\WinRAR
Client Hash = "{hex values}"

Information Theft

This spyware uses the following lists of user names and passwords to access password-protected shared files:

• samantha
• michelle
• david
• eminem
• scooter
• asdfasdf
• sammy
• baby
• diamond
• maxwell
• justin
• james
• chicken
• danielle
• iloveyou2
• fuckoff
• prince
• junior
• rainbow
• fuckyou1
• nintendo
• peanut
• none
• church
• bubbles
• robert
• destiny
• loving
• gfhjkm
• mylove
• jasper
• hallo
• cocacola
• helpme
• nicole
• guitar
• billgates
• looking
• scooby
• joseph
• genesis
• forum
• emmanuel
• cassie
• victory
• passw0rd
• foobar
• ilovegod
• nathan
• blabla
• digital
• peaches
• football1
• power
• thunder
• gateway
• iloveyou!
• football
• tigger
• corvette
• angel
• killer
• creative
• google
• zxcvbnm
• startrek
• ashley
• cheese
• sunshine
• christ
• soccer
• qwerty1
• friend
• summer
• merlin
• phpbb
• jordan
• saved
• dexter
• viper
• winner
• sparky
• windows
• 123abc
• lucky
• anthony
• jesus
• ghbdtn
• admin
• hotdog
• baseball
• password1
• dragon
• trustno1
• jason
• internet
• mustdie
• john
• letmein
• mike
• knight
• jordan23
• abc123
• red123
• praise
• freedom
• jesus1
• london
• computer
• microsoft
• muffin
• qwert
• mother
• master
• qazwsx
• samuel
• canada
• slayer
• rachel
• onelove
• qwerty
• prayer
• iloveyou1
• whatever
• god
• password
• blessing
• snoopy
• 1q2w3e4r
• cookie
• chelsea
• pokemon
• hahaha
• aaaaaa
• hardcore
• shadow
• welcome
• mustang
• bailey
• blahblah
• matrix
• jessica
• stella
• benjamin
• testing
• secret
• trinity
• richard
• peace
• shalom
• monkey
• iloveyou
• thomas
• blink182
• jasmine
• purple
• test
• angels
• grace
• hello
• poop
• blessed
• heaven
• hunter
• pepper
• john316
• cool
• buster
• andrew
• faith
• ginger
• hockey
• hello1
• angel1
• superman
• enter
• daniel
• forever
• nothing
• dakota
• kitten
• asdf
• banana
• gates
• flower
• taylor
• lovely
• hannah
• princess
• compaq
• jennifer
• myspace1
• smokey
• matthew
• harley
• rotimi
• fuckyou
• soccer1
• single
• joshua
• green
• 123qwe
• starwars
• love
• silver
• austin
• michael
• amanda
• charlie
• bandit
• chris
• happy
• hope
• maggie
• maverick
• online
• spirit
• george
• friends
• dallas
• adidas
• 1q2w3e
• orange
• testtest
• asshole
• apple
• biteme
• william
• mickey
• asdfgh
• wisdom
• batman

It attempts to steal stored account information used in the following installed File Transfer Protocol (FTP) clients or file manager software:

• 32BitFtp
• 3D-FTP
• AceBIT
• Adobe
• BitKinex
• Bullet Proof FTP
• CoffeeCup Software
• Core FTP
• Cryer WebSitePublisher
• Cyberduck
• DeluxeFTP
• EasyFTP
• Estsoft ALFTP
• ExpanDrive
• FTP Commander
• FTP Control
• FTP Explorer
• FTP Navigator
• FTP Now
• FTPGetter
• FTPRush
• FTPShell
• Far Manager
• FastTrackFTP
• FileZilla
• FireFTP
• FlashFXP 3
• FlashFXP 4
• FlashPeak BlazeFtp
• FreshFTP
• Frigate3
• GPSoftware Directory Opus
• Ghisler Total Commander
• Global Downloader
• GlobalSCAPE CuteFTP 6 Home
• GlobalSCAPE CuteFTP 6 Professional
• GlobalSCAPE CuteFTP 7 Home
• GlobalSCAPE CuteFTP 7 Professional
• GlobalSCAPE CuteFTP 8 Home
• GlobalSCAPE CuteFTP 8 Professional
• GlobalSCAPE CuteFTP 9
• GlobalSCAPE CuteFTP Lite
• GlobalSCAPE CuteFTP Pro
• GoFTP
• INSoftware NovaFTP
• Ipswitch WS_FTP
• LeapWare LeapFTP
• LeechFTP
• LinasFTP
• MAS-Soft FTPInfo
• MS IE FTP
• Martin Prikryl
• My FTP
• NCH Software ClassicFTP
• NCH Software Fling
• NetDrive
• NetSarang
• NexusFile
• Nico Mak Computing WinZip
• Notepad++ NppFTP
• Opera
• RhinoSoft FTPVoyager
• Robo-FTP 3.7
• SimonTatham PuTTY
• SmartFTP
• SoftX FTP Client
• Sota FFFTP
• South River Technologies WebDrive
• Staff-FTP
• TurboFTP
• UltraFXP
• VanDyke SecureFX
• Visicom Media
• WinFTP
• SFTP

It gathers the following account information from any of the mentioned File Transfer Protocol (FTP) clients or file manager software:

• Username
• Password
• User ID
• Host Address
• Directory List
• Port Number
• Terminal Type
• Server Name
• Server Type

It attempts to steal stored email credentials from the following:

• IncrediMail
• Microsoft Outlook
• Microsoft Windows Live Mail
• Microsoft Windows Mail
• Poco Systems Pocomail
• RimArts Becky! Internet Mail
• RIT The Bat!
• Thunderbird

It attempts to get stored information such as user names, passwords, and hostnames from the following browsers:

• Bromium
• Chromium
• Comodo
• Epic
• FastStone Browser
• Flock
• Google Chrome
• K-Meleon
• MapleStudio ChromePlus
• Mozilla Firefox
• Mozilla SeaMonkey
• Nichrome
• Opera
• RockMelt
• Yandex
• Internet Explorer

Other Details

This spyware connects to the following website to send and receive information:

• http://{BLOCKED}boss.bid/alpha/gate.php

It deletes the initially executed copy of itself

NOTES:

This spyware may also possess the capability to steal information from various Bitcoin wallets. It searches and attempts to extract information from the following files:

• electrum.dat (Electrum)
• wallet (Armory)
• wallet (MultiBit)
• wallet.dat (Anoncoin)
• wallet.dat (BBQcoin)
• wallet.dat (Bitcoin)
• wallet.dat (Bytecoin)
• wallet.dat (Craftcoin)
• wallet.dat (Devcoin)
• wallet.dat (Digitalcoin)
• wallet.dat (Fastcoin)
• wallet.dat (Feathercoin)
• wallet.dat (Florincoin)
• wallet.dat (Franko)
• wallet.dat (Freicoin)
• wallet.dat (GoldCoin (GLD))
• wallet.dat (I0coin)
• wallet.dat (Infinitecoin)
• wallet.dat (Ixcoin)
• wallet.dat (Junkcoin)
• wallet.dat (Litecoin)
• wallet.dat (Luckycoin)
• wallet.dat (Megacoin)
• wallet.dat (Mincoin)
• wallet.dat (Namecoin)
• wallet.dat (NovaCoin)
• wallet.dat (Phoenixcoin)
• wallet.dat (PPCoin)
• wallet.dat (Primecoin)
• wallet.dat (ProtoShares)
• wallet.dat (Quarkcoin)
• wallet.dat (Tagcoin)
• wallet.dat (Terracoin)
• wallet.dat (Worldcoin)
• wallet.dat (Yacoin)
• wallet.dat (Zetacoin)