TSPY_FAREIT.YYSUB

Infection Channel: Dropped by other malware

This spyware may be dropped by other malware.

It uses certain lists of user names and passwords to access password-protected shared files.

It connects to certain websites to send and receive information. It deletes the initially executed copy of itself.

File Size: 147,456 bytes

File Type: EXE

Memory Resident: Yes

Initial Samples Received Date: 01 Apr 2016

Payload: Connects to URLs/IPs, Downloads files

Arrival Details

This spyware may be dropped by the following malware:

W2KM_FAREIT.ALB

Installation

This spyware drops the following component file(s):

%User Temp%\{random}.bat - deleted after execution

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other System Modifications

This spyware adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\WinRAR
HWID = "{hex values}"

HKEY_CURRENT_USER\Software\WinRAR
Client Hash = "{hex values}"

Download Routine

This spyware accesses the following websites to download files:

http://www.{BLOCKED}arden.net/system/logs/task.exe
http://www.{BLOCKED}a.com/system/logs/task.exe
http://www.{BLOCKED}ang.com.tw/system/logs/task.exe

Information Theft

This spyware uses the following lists of user names and passwords to access password-protected shared files:

danielle
iloveyou2
fuckoff
prince
junior
rainbow
fuckyou1
nintendo
peanut
none
church
bubbles
robert
destiny
loving
gfhjkm
mylove
jasper
hallo
cocacola
helpme
nicole
guitar
billgates
looking
scooby
joseph
genesis
forum
emmanuel
cassie
victory
passw0rd
foobar
ilovegod
nathan
blabla
digital
peaches
football1
power
thunder
gateway
iloveyou!
football
tigger
corvette
angel
killer
creative
google
zxcvbnm
startrek
ashley
cheese
sunshine
christ
soccer
qwerty1
friend
summer
merlin
phpbb
jordan
saved
dexter
viper
winner
sparky
windows
123abc
lucky
anthony
jesus
ghbdtn
admin
hotdog
baseball
password1
dragon
trustno1
jason
internet
mustdie
john
letmein
mike
knight
jordan23
abc123
red123
praise
freedom
jesus1
london
computer
microsoft
muffin
qwert
mother
master
qazwsx
samuel
canada
slayer
rachel
onelove
qwerty
prayer
iloveyou1
whatever
god
password
blessing
snoopy
1q2w3e4r
cookie
chelsea
pokemon
hahaha
aaaaaa
hardcore
shadow
welcome
mustang
bailey
blahblah
matrix
jessica
stella
benjamin
testing
secret
trinity
richard
peace
shalom
monkey
iloveyou
thomas
blink182
jasmine
purple
test
angels
grace
hello
poop
blessed
heaven
hunter
pepper
john316
cool
buster
andrew
faith
ginger
hockey
hello1
angel1
superman
enter
daniel
forever
nothing
dakota
kitten
asdf
banana
gates
flower
taylor
lovely
hannah
princess
compaq
jennifer
myspace1
smokey
matthew
harley
rotimi
fuckyou
soccer1
single
joshua
green
123qwe
starwars
love
silver
austin
michael
amanda
charlie
bandit
chris
happy
hope
maggie
maverick
online
spirit
george
friends
dallas
adidas
1q2w3e
orange
testtest
asshole
apple
biteme
william
mickey
asdfgh
wisdom
batman
pass

It attempts to steal stored account information used in the following installed File Transfer Protocol (FTP) clients or file manager software:

32BitFtp
3D-FTP
AceBIT
Adobe
BitKinex
Bullet Proof FTP
CoffeeCup Software
Core FTP
Cryer WebSitePublisher
Cyberduck
DeluxeFTP
EasyFTP
Estsoft ALFTP
ExpanDrive
FTP Commander
FTP Control
FTP Explorer
FTP Navigator
FTP Now
FTPGetter
FTPRush
FTPShell
Far Manager
FastTrackFTP
FileZilla
FireFTP
FlashFXP 3
FlashFXP 4
FlashPeak BlazeFtp
FreshFTP
Frigate3
GPSoftware Directory Opus
Ghisler Total Commander
Global Downloader
GlobalSCAPE CuteFTP 6 Home
GlobalSCAPE CuteFTP 6 Professional
GlobalSCAPE CuteFTP 7 Home
GlobalSCAPE CuteFTP 7 Professional
GlobalSCAPE CuteFTP 8 Home
GlobalSCAPE CuteFTP 8 Professional
GlobalSCAPE CuteFTP 9
GlobalSCAPE CuteFTP Lite
GlobalSCAPE CuteFTP Pro
GoFTP
INSoftware NovaFTP
Ipswitch WS_FTP
LeapWare LeapFTP
LeechFTP
LinasFTP
MAS-Soft FTPInfo
MS IE FTP
Martin Prikryl
My FTP
NCH Software ClassicFTP
NCH Software Fling
NetDrive
NetSarang
NexusFile
Nico Mak Computing WinZip
Notepad++ NppFTP
Opera
RhinoSoft FTPVoyager
Robo-FTP 3.7
SimonTatham PuTTY
SmartFTP
SoftX FTP Client
Sota FFFTP
South River Technologies WebDrive
Staff-FTP
TurboFTP
UltraFXP
VanDyke SecureFX
Visicom Media
WinFTP
SFTP

It gathers the following account information from any of the mentioned File Transfer Protocol (FTP) clients or file manager software:

Username
Password
User ID
Host Address
Directory List
Port Number
Terminal Type
Server Name
Server Type

It attempts to steal stored email credentials from the following:

IncrediMail
Microsoft Outlook
Microsoft Windows Live Mail
Microsoft Windows Mail
Poco Systems Pocomail
RimArts Becky! Internet Mail
RIT The Bat!
Thunderbird

It attempts to get stored information such as user names, passwords, and hostnames from the following browsers:

Bromium
Chromium
Comodo
Epic
FastStone Browser
Flock
Google Chrome
K-Meleon
MapleStudio ChromePlus
Mozilla Firefox
Mozilla SeaMonkey
Nichrome
Opera
RockMelt
Yandex
Internet Explorer

Other Details

This spyware connects to the following website to send and receive information:

http://{BLOCKED}ntsin.ru/gate.php
http://{BLOCKED}adint.ru/gate.php
http://{BLOCKED}eher.ru/gate.php

It does the following:

It executes the following command:
cmd /K

It deletes the initially executed copy of itself

Minimum Scan Engine: 9.800

FIRST VSAPI PATTERN FILE: 12.440.03

FIRST VSAPI PATTERN DATE: 01 Apr 2016

VSAPI OPR PATTERN File: 12.441.00

VSAPI OPR PATTERN Date: 02 Apr 2016

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Remove the malware/grayware file that dropped/downloaded TSPY_FAREIT.YYSUB. (Note: Please skip this step if the threat(s) listed below have already been removed.)

W2KM_FAREIT.ALB

Step 4

Scan your computer with your Trend Micro product and note files detected as TSPY_FAREIT.YYSUB

Step 5

Restart in Safe Mode

[ Learn More ]

Step 6

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_CURRENT_USER\Software\WinRAR
- HWID = "{hex values}"
In HKEY_CURRENT_USER\Software\WinRAR
- Client Hash = "{hex values}"

HKEY_CURRENT_USER>Software>WinRAR&&HWID = "{hex values}"||HKEY_CURRENT_USER>Software>WinRAR&&Client Hash = "{hex values}"

Step 7

Search and delete the file detected as TSPY_FAREIT.YYSUB

[ Learn More ]

Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden files in the search result.

Step 8

Restart in normal mode and scan your computer with your Trend Micro product for files detected as TSPY_FAREIT.YYSUB. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Did this description help? Tell us how we did.

OVERVIEW

TECHNICAL DETAILS

SOLUTION