Trojan.Win32.PRIVATELOADER.YXDBSZ

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain websites to send and receive information.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %User Profile%\Pictures\Minor Policy\{Random Characters}.exe
  • These random files are detected as:
    • TrojanSpy.Win32.VIDAR.YXDG4Z
    • Trojan.Win32.PRIVATELOADER.YXDGVZ
    • Trojan.Win32.PRIVATELOADER.YXDE4Z
    • TROJ_GEN.R002C0DGV23
    • TROJ_GEN.R002C0DFF23
    • TROJ_GEN.R002C0XGV23
• %Temporary Internet Files%\6523.exe
• %Temporary Internet Files%\file.exe
• %Temporary Internet Files%\g.exe
• %Temporary Internet Files%\okka25.exe
• %Temporary Internet Files%\photo220.exe
• %Temporary Internet Files%\setup294.exe
• %Temporary Internet Files%\clip.dll
• %Temporary Internet Files%\cookie:{User Name}@vk.com/
• %Temporary Internet Files%\{Random Characters}.bmp

It adds the following processes:

• %User Profile%\Pictures\Minor Policy\{Random Characters}.exe ← Multiple files

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other System Modifications

This Trojan adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Group Policy Objects\
{SID}Machine\SOFTWARE\Policies\
Microsoft\Windows Defender\Extensions
exe = (default)

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Group Policy Objects\
{SID}Machine\SOFTWARE\Policies\
Microsoft\Windows Defender\Exclusions
Exclusions_Extensions = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Group Policy Objects\
{SID}Machine\SOFTWARE\Policies\
Microsoft\Windows Defender
DisableAntiSpyware = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Group Policy Objects\
{SID}Machine\SOFTWARE\Policies\
Microsoft\Windows Defender
DisableRoutinelyTakingAction = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Group Policy Objects\
{SID}Machine\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableBehaviorMonitoring = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Group Policy Objects\
{SID}Machine\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableAccessProtection = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Group Policy Objects\
{SID}Machine\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableScanOnRealtimeEnable = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Group Policy Objects\
{SID}Machine\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableRealtimeMonitoring = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Group Policy Objects\
{SID}Machine\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableIOAVProtection = 1

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Group Policy Objects\
{SID}Machine\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableRawWriteNotification = 1

(Note: The default value data of the said registry entry is 0.)

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.4/download/Service32.exe
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.198/g.exe
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.207:3002/file.exe
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.47/info/photo220.exe
• http://{BLOCKED}i.com/dl/6523.exe
• http://{BLOCKED}uiehgha.com/m/okka25.exe
• https://{BLOCKED}apps.site/setup294.exe

Other Details

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Group Policy Objects\
{SID}User
(default) = (value not set)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Group Policy Objects\
{SID}Machine
(default) = (value not set)

It connects to the following URL(s) to get the affected system's IP address:

• https://{BLOCKED}o.io/widget
• https://{BLOCKED}p.com
• https://www.{BLOCKED}d.com/geoip/v2.1/city/me
• https://www.{BLOCKED}d.com/en/locate-my-ip-address
• https://{BLOCKED}ocation.io
• https://{BLOCKED}er.org/1nhuM4.hjs

It connects to the following website to send and receive information:

• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.214/api/tracemap.php
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.202/api/tracemap.php
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.205/api/tracemap.php
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.60/api/tracemap.php
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.60/api/firegate.php
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.74/pineapple.php?pub=mixinte
• https://{BLOCKED}s.ru/12hYs7.mp3
• https://{BLOCKED}k.com/doc{Random Numbers}hash={Random Alphanumeric Characters}
• https://{BLOCKED}k.com:80{Random Numbers}hash={Random Alphanumeric Characters}

It does the following:

• It gathers information from the following:
  • Wallets:
    • atomic
    • Atomic Wallet
    • Binance
    • binancechain
    • Electrum
    • Exodus
    • Metamask
    • Monero
    • MultiDoge
  • Browser activities on the following websites:
    • 24x7rooms.com
    • 53.com
    • 796.com
    • aacreditunion.org
    • abreuonline.com
    • abucoins.com
    • adonis.com
    • advcash.com
    • adviacu.org
    • affinityfcu.com
    • aidosmarket.com
    • alaskausa.org
    • allcoin.com
    • alliantcreditunion.org
    • ally.com
    • almundo.com.ar
    • altcointrader.co.za
    • amazon.ca
    • amazon.de
    • amazon.it
    • americafirst.com
    • americafirst.com
    • americaneagle.org
    • americanheritagecu.org
    • andrewsfcu.org
    • apcocu.org
    • apcu.com
    • applefcu.org
    • arenabitcoin.com
    • arizonafederal.org
    • ascend.org
    • ascendex.com
    • atomars.com
    • aws.amazon.com
    • bankofamerica.com
    • bankofmelbourne.com.au
    • bayportcu.org
    • bcex.ca
    • bcu.org
    • becu.org
    • bellco.org
    • bethpagefcu.com
    • bfsfcu.org
    • big.one
    • bilaxy.com
    • binance.com
    • binance.com
    • bitbank.cc
    • bitbanktrade.jp
    • bitcointoyou.com
    • bitcointrade.com
    • bitconnect.co
    • bitfex.trade
    • bitfinex.com
    • bitfinex.com
    • bitflyer.com
    • bitforex.com
    • bithumb.com
    • bitker.com
    • bitkonan.com
    • bitkub.com
    • bitkub.com
    • bitlish.com
    • bitmarket.net
    • bitmart.com
    • bitmaszyna.pl
    • bitmax.io
    • bitmex.com
    • bitonic.nl
    • bitopro.com
    • bitpanda.com
    • bitpanda.com
    • bitsblockchain.net
    • bitso.com
    • bitspark.io
    • bitstamp.net
    • bitstarcoin.com
    • bittrex.com
    • bittrex.com
    • bittrex.zendesk.com
    • bittylicious.com
    • blockchain.com
    • blockchain.com
    • blockchain.info
    • bmo.com
    • bmo.com
    • bonotel.com
    • bookohotel.com
    • braziliex.com
    • bt.cx
    • btc-alpha.com
    • btcbox.cojp
    • btcexa.com
    • btc-exchange.com
    • btcmarkets.net
    • btcnext.io
    • btc-trade.com.ua
    • btcturk.com
    • btcxindia.com
    • bx.in.th
    • ca.ovh.com
    • calcoastcu.org
    • campuscu.com
    • canvas.org
    • capcomfcu.org
    • cashierest.com
    • catex.io
    • ccu.com
    • cefcu.com
    • cex.io
    • chaoex.com
    • chartway.com
    • chevronfcu.org
    • citadelbanking.com
    • citex.co.kr
    • cloud.huawei.com
    • cloud.ibm.com
    • cloud.tencent.com
    • coastal24.com
    • coin.z.com
    • coinall.com
    • coinbase.com
    • coinbase.com
    • coinbene.com
    • coinbit.co.kr
    • coincheck.com
    • coincorner.com
    • coindeal.com
    • coineal.com
    • coinegg.com
    • coinexchange.io
    • coinfinit.com
    • coinfloor.co.uk
    • coingather.com
    • coingi.com
    • coinmarketcap.com
    • coinmate.io
    • coinmex.com
    • coinnest.co.kr
    • coinome.com
    • coinone.co.kr
    • coinpayments.net
    • coinpit.io
    • coinrail.co.kr
    • coins.ph
    • coins.th
    • coinsbank.com
    • coinsecure.in
    • coinsmarkets.com
    • coinspot.io
    • coinsquare.com
    • cointiger.com
    • coinz.com
    • coinzo.com
    • communityamerica.com
    • communityfirstcu.org
    • communityfirstfl.org
    • connexuscu.org
    • console.scaleway.com
    • cpdax.com
    • credithuman.com
    • crypto.com
    • cryptobridge.freshdesk.com
    • crypto-bridge.org
    • cryptofresh.com
    • cryptology.com
    • cryptonator.com
    • cryptopia.co.nz
    • csecreditunion.com
    • ctl.io
    • cu.com
    • dabtc.com
    • dcex.com
    • dcexchange.ru
    • dcexe.com
    • dcu.org
    • decentrex.com
    • deltacommunitycu.com
    • deribit.com
    • desertfinancial.com
    • dfcufinancial.com
    • dgtmarket.com
    • didatravel.com
    • digitalocean.com
    • dobitrade.com
    • dogechain.info
    • dotwconnect.com
    • dsx.uk
    • easternbank.com
    • ecu.com
    • ecu.org
    • eecu.org
    • eetglobal.com
    • eglinfcu.org
    • elevationscu.com
    • empowerfcu.com
    • ent.com
    • escalabeds.com
    • esl.org
    • etherflyer.com
    • etrade.com
    • excambriorex.com
    • exir.io
    • exir.tech
    • exmarkets.com
    • exmo.com
    • exmo.com
    • exratesme
    • exx.com
    • ezbtc.ca
    • fairwinds.org
    • fairwinds.org
    • fastpayhotels.com
    • fatbtc.com
    • fatbtc.com
    • fcoin.com
    • fcoin.com
    • fexpro.net
    • finexbox.com
    • firstcommunity.com
    • firsttechfed.com
    • firsttechfed.com
    • flowbtc.combr
    • foundersfcu.com
    • foxbit.combr
    • ftx.com
    • ftx.com
    • funpay.ru
    • gate.io
    • gate.io
    • gatehub.net
    • gdac.com
    • gdax.com
    • gecreditunion.org
    • gecu.com
    • gemini.com
    • genisyscu.org
    • georgiasown.org
    • gesa.com
    • golden1.com
    • gopax.co.kr
    • greendot.com
    • greenstate.org
    • growfinancial.org
    • gtefinancial.org
    • gwcu.org
    • hetzner.com
    • hitbtc.com
    • hitbtc.com
    • hoteldo.com.mx
    • hotelspro.com
    • huobi.com
    • huobi.com.
    • hvfcu.org
    • iccu.com
    • iccu.comdesertfinancial.com
    • imb.com.au
    • imcu.com
    • independentreserve.com
    • infinitycoin.exchange
    • ing.com.au
    • instantbitex.com
    • itbit.com
    • jex.com
    • joviafinancial.com
    • jscfcu.org
    • jubi.com
    • jumbonline.com
    • kaluahtours.com
    • kfcu.org
    • kinecta.org
    • kiwi-coin.com
    • koineks.com
    • koinex.in
    • koinim.com
    • korbit.co.kr
    • kraken.com
    • kraken.com
    • kucoin.com
    • kucoin.com
    • kuna.io
    • landmarkcu.com
    • langleyfcu.org
    • lbank.info
    • leaseweb.com
    • leoxchange.com
    • lgfcu.org
    • linode.com
    • liquid.com
    • livecoin.net
    • livecoin.net
    • lmcu.org
    • localbitcoins.com
    • localtrade.cc
    • login.blockchain.com
    • logixbanking.com
    • lotsofhotels.com
    • luno.com
    • luno.com
    • lykke.com
    • macu.com
    • magnr.com
    • maicoin.com
    • marcus.com
    • members1st.org
    • mercatox.com
    • mercatox.com
    • metrocu.org
    • midflorida.com
    • mikinet.co.uk
    • miningpoolhub.com
    • missionfed.com
    • missionfed.com
    • misterroom.com
    • mixcoins.com
    • morganstanley.com
    • mr.exchange
    • msgcu.org
    • msufcu.org
    • mtb.com
    • mxc.com
    • my.dogechain.info
    • myeecu.org
    • mynxt.info
    • nasafcu.com
    • navigantcu.org
    • navyfederal.org
    • ncsecu.org
    • neofinancial.com
    • neraex.pro
    • nevbit.com
    • nexustours.com
    • nlexch.com
    • nocks.com
    • novaexchange.com
    • numericacu.com
    • nusenda.org
    • nuvisionfederal.com
    • nymcu.org
    • nzbcx.com
    • oceanex.pro
    • okcoin.com
    • okex.com
    • olympiaeurope.com
    • omgfin.com
    • omnidex.io
    • onpointcu.com
    • openledger.info
    • oracle.com
    • ore.bz
    • ornlfcu.com
    • pancakeswap.finance
    • paribu.com
    • patelco.org
    • paymium.com
    • payoneer.com
    • paypal.com
    • paypal.com
    • pcu.org
    • penfed.org
    • pffcu.org
    • phoenixnap.com
    • poloniex.com
    • poloniex.com
    • portal.azure.com
    • psecu.com
    • psfcu.com
    • qryptos.com
    • quadrigacx.com
    • quoine.com
    • rackspace.com
    • rbcroyalbank.com
    • rbfcu.org
    • redwoodcu.org
    • regionalaustraliabank.com
    • regionalaustraliabank.com.au
    • rfcu.com
    • rightbtc.com
    • rippex.net
    • ripplefox.com
    • robinhood.com
    • robinsfcu.org
    • safecu.org
    • safecu.org
    • santander.com
    • satoshitango.com
    • satowallet.com
    • sccu.com
    • schools.org
    • schoolsfirstfcu.org
    • schoolsfirstfcu.org
    • sdccu.com
    • sdfcu.org
    • secumd.org
    • secumd.org
    • sefcu.com
    • servicecu.org
    • sfcu.org
    • shortex.net
    • shortex.net
    • simex.global
    • simex.global
    • slfcu.org
    • sorare.com
    • southxchange.com
    • spectrocoin.com
    • ssfcu.org
    • sso.ctl.io
    • starone.org
    • statefarmfcu.com
    • stex.com
    • stgeorge.com.au
    • summitcreditunion.com
    • suncoastcreditunion.com
    • suncorp.com.au
    • tboholidays.com
    • tcunet.com
    • tdax.com
    • teachersfcu.org
    • techcu.com
    • therocktrading.com
    • tidex.com
    • tinkerfcu.org
    • tokenize.exchange
    • tokens.net
    • towerfcu.org
    • trade.io
    • tradeogre.com
    • traviscu.org
    • truliantfcu.org
    • trumarkonline.org
    • ttcu.com
    • tvacreditunion.com
    • ucu.org
    • ufcu.org
    • unfcu.org
    • unifyfcu.com
    • unitedfcu.com
    • uphold.com
    • usaa.com
    • uwcu.org
    • vacu.org
    • vantagewest.org
    • vbtc.exchange
    • veridiancu.org
    • vindax.com
    • visionsfcu.org
    • volabit.com
    • vultr.com
    • vwlpro.com
    • wallet.uphold.com
    • wecu.com
    • wescom.org
    • wingsfinancial.com
    • wpcu.coop
    • wsecu.org
    • yobit.io
    • yobit.net
    • zb.com