live casino online

TSPY_FLAME.M

October 09, 2012
 Analysis by: Lord Alfred Remorin
 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 REPORTED INFECTION:
 SYSTEM IMPACT RATING:
 INFORMATION EXPOSURE:

  • Threat Type: Spyware

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Downloaded from the Internet, Dropped by other malware

This spyware may be dropped by other malware.

It executes commands from a remote malicious user, effectively compromising the affected system.

  TECHNICAL DETAILS

File Size:

139,264 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

15 Aug 2012

Payload:

Connects to URLs/IPs, Compromises system security

Arrival Details

This spyware may be dropped by the following malware:

  • TROJ_MDROPPER.CD

Installation

This spyware drops the following copies of itself into the affected system:

  • %User Profile%\NetHood\NetHood.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It drops the following files:

  • %User Startup%\(Empty).lnk

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

Backdoor Routine

This spyware executes the following commands from a remote malicious user:

  • Execute command shell
  • Get system information
  • Create/terminate process
  • Download and execute other malicious files
  • Upload files to remote host

It connects to the following URL(s) to send and receive commands from a remote malicious user:

  • http://freetibb.{BLOCKED}p.biz

  SOLUTION

Minimum Scan Engine:

9.200

FIRST VSAPI PATTERN FILE:

9.326.08

FIRST VSAPI PATTERN DATE:

15 Aug 2012

VSAPI OPR PATTERN File:

9.327.00

VSAPI OPR PATTERN Date:

15 Aug 2012

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you to allow full scanning of your computer.

Step 2

Remove the malware/grayware file that dropped/downloaded TSPY_FLAME.M