TSPY_FLAME.M
Windows 2000, Windows XP, Windows Server 2003
Threat Type: Spyware
Destructiveness: No
Encrypted: No
In the wild: Yes
OVERVIEW
Downloaded from the Internet, Dropped by other malware
This spyware may be dropped by other malware.
It executes commands from a remote malicious user, effectively compromising the affected system.
TECHNICAL DETAILS
139,264 bytes
EXE
Yes
15 Aug 2012
Connects to URLs/IPs, Compromises system security
Arrival Details
This spyware may be dropped by the following malware:
- TROJ_MDROPPER.CD
Installation
This spyware drops the following copies of itself into the affected system:
- %User Profile%\NetHood\NetHood.exe
(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)
It drops the following files:
- %User Startup%\(Empty).lnk
(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)
Backdoor Routine
This spyware executes the following commands from a remote malicious user:
- Execute command shell
- Get system information
- Create/terminate process
- Download and execute other malicious files
- Upload files to remote host
It connects to the following URL(s) to send and receive commands from a remote malicious user:
- http://freetibb.{BLOCKED}p.biz
SOLUTION
9.200
9.326.08
15 Aug 2012
9.327.00
15 Aug 2012
Step 1
For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you to allow full scanning of your computer.
Step 2
Remove the malware/grayware file that dropped/downloaded TSPY_FLAME.M