TrojanSpy.Win32.INFOSTEAL.ERG

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy drops the following files:

• %Program Files%\Google\Chrome\Application\winhttp.dll <- copy of %Temporary Internet Files%\Content.IE5\{random}\ChromeX86.dat or %Temporary Internet Files%\Content.IE5\{random}\ChromeX64.dat
• %User Temp%\{Random number}.dat <- copies of "\Google\Chrome\User Data\Default\Cookies", "\Google\Chrome\User Data\Default\Login Data", "\Google\Chrome\User Data\Profile 1\Login Data"

(Note: %Temporary Internet Files% is the Temporary Internet Files folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temporary Internet Files on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Microsoft\Windows\Temporary Internet Files on Windows Vista and 7, or C:\Users\{user name}\AppData\Local\Microsoft\Windows\INetCache on Windows 8.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• yesterday

Other System Modifications

This Trojan Spy adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
telezilla
telezilla = "乕"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Ebayssistant 1.0
Database = "{Malware path}\{Malware Filename}.exe"

Download Routine

This Trojan Spy connects to the following URL(s) to download its component file(s):

• http://www.{BLOCKED}caddress.com/D/ChromeX64.dat -> 64bit Operating System
• http://www.{BLOCKED}caddress.com/D/ChromeX86.dat -> 32bit Operating System

It saves the files it downloads using the following names:

• %Temporary Internet Files%\Content.IE5\{random}\ChromeX86.dat <- for 32-bit Operating System
• %Temporary Internet Files%\Content.IE5\{random}\ChromeX64.dat <- for 64-bit Operating System

(Note: %Temporary Internet Files% is the Temporary Internet Files folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temporary Internet Files on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Microsoft\Windows\Temporary Internet Files on Windows Vista and 7, or C:\Users\{user name}\AppData\Local\Microsoft\Windows\INetCache on Windows 8.)

Information Theft

This Trojan Spy gathers the following data:

• System Information (Machine Name, Operating System)
• Browsers
• User Domain
• User Profile
• Facebook Account Credentials
  • Access token
  • Businees ID
  • Account ID
  • Credit Card Details
  • Paypal Details

Stolen Information

This Trojan Spy sends the gathered information via HTTP POST to the following URL:

• http://www.{BLOCKED}caddress.com/index.php
• http://www.{BLOCKED}caddress.com/index.php/Index/installresult

Other Details

This Trojan Spy does the following:

• This Trojan Spy uses Google Chrome browser cookies and login data to try to login to the victim's Facebook account.
• After successful login, this Trojan Spy attempts to steal the victim's banking information by querying the victim's Facebook payment information.
• This Trojan Spy connects to the following Facebook URL to steal victim's information:
  • https://www.facebook.com/payments/settings/payment_methods/?fb_dtsg_ag=&__a=1&__req=b&__be=0&__pc=PHASED%3Aufi_home_page_pkg&dpr=1&__rev=4646846&jazoest=28303&__spin_r=4646846&__spin_b=trunk&__spin_t=1545185175
  • https://www.facebook.com/settings?tab=payments§ion=settings
  • https://www.facebook.com/settings?tab=account§ion=email
  • https://graph.facebook.com/v3.0/act_?_reqSrc=AdsPEPaymentMethodDataManager&fields=[%22all_payment_methods{pm_credit_card{account_id,display_string,exp_month,exp_year}}%22]&include_headers=false&locale=en_US&method=get&pretty=0&suppress_http_code=1&access_token
  • https://www.facebook.com/ads/manager/account_settings/account_billing/
  • https://www.facebook.com/bookmarks/pages?ref_type=logout_gear
  • https://www.facebook.com/profile.php?sk=friends
• It adds the following strings as HTTP Header:
  • "Cookie: " "User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36"