TrojanSpy.AutoIt.DARKGATE.AA

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It logs a user's keystrokes to steal information.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy drops the following files:

• %System Root%\temp\AutoIt3.exe
• %System Root%\temp\{7 Characters Generated for "au3file"}.au3
• %ProgramData%\{7 Characters Generated for "mainfolder"}\AutoIt3.exe
• %ProgramData%\{7 Characters Generated for "mainfolder"}\{7 Characters Generated for "au3file"}.au3
• %ProgramData%\{7 Characters Generated for "mainfolder"}\{7 Characters Generated for "logsfolder"}\{7 Characters Generated for "settings"} ← Encrypted malware settings
• %ProgramData%\{7 Characters Generated for "mainfolder"}\{7 Characters Generated for "logsfolder"}\{DD-MM-YYYY}.log ← Encrypted keylogs and clipboard data

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)

It creates the following folders:

• %System Root%\temp
• %ProgramData%\{7 Characters Generated for "mainfolder"}
• %ProgramData%\{7 Characters Generated for "mainfolder"}\{7 Characters Generated for "logsfolder"}
• %User Temp%\{7 Characters Generated for "supertemp"}

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Autostart Technique

This Trojan Spy drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\{7 Characters Generated for the LNK file}.lnk

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows 2003(32-bit), XP and 2000(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit), 10(64-bit).)

Other System Modifications

This Trojan Spy modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\Windows Error Reporting
DontShowUI = 1

Backdoor Routine

This Trojan Spy executes the following commands from a remote malicious user:

• Collect system information and other data
• Start or stop malware components, control malware settings
• Start, stop, and configure cryptominer
• Steal data from various programs and data sources
• Initiate hVNC connection, hAnydesk, remote desktop protocol, execute commands
• Steal browser data
• Browse directories and manage files
• Update the malware, download additional components

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}vservicceoffice.net:80

Information Theft

This Trojan Spy gathers the following data:

• Language Code ID
• Username
• Computer name
• Parent process
• Number of seconds from the user’s last interaction with the PC
• Processor information
• Graphics information
• Total Physical Memory space in MB
• OS Information
• Admin privileges
• Malware start time
• Name of Antivirus found
• Malware version
• Port number
• Clipboard data

It logs a user's keystrokes to steal information.

Stolen Information

This Trojan Spy sends the gathered information via HTTP POST to the following URL:

• http://{BLOCKED}vservicceoffice.net:80

Other Details

This Trojan Spy does the following:

• It proceeds to its malicious routine if the following conditions are satisfied:
  • Existence of %Program Files% directory
  • Username is not SYSTEM
  • Malware file has a .au3 extension
• It displays the following if there is no ".au3" file found:
  
• Starts a process to stay memory-resident by injecting code to the added process:
  • C:\Program Files (x86)\{Path of a file with .exe extension}
  • %System%\cmd.exe ← If C:\Program Files (x86) path does not exist or no .exe file was found
• It checks the following to identify Anti-Virus and Security Applications found in the system:
  • Existence of the following directory:
    • %ProgramData%\Bitdefender
    • %Program Files%\Bitdefender
    • %ProgramData%\AVAST
    • %Program Files%\AVAST Software
    • %ProgramData%\AVG
    • %Program Files%\AVG
    • %ProgramData%\Kaspersky Lab
    • %Program Files% (x86)\Avira
    • %Program Files% (x86)\IObit
    • %Program Files%\Malwarebytes
    • %Program Files% (x86)\F-Secure
    • %Program Files%\Quick Heal
    • %ProgramData%\Emsisoft
    • %Program Files%\Malwarebytes
  
  
  • Running process:
    • egui
    • ns.exe
    • nis.exe
    • nortonsecurity.exe
    • smc.exe
    • uiseagnt.exe
    • mcshield.exe
    • mcuicnt.exe
    • bytefence.exe
    • cis.exe
    • mbam.exe
    • vkise.exe
    • superantispyware.exe
    • totalav.exe
    • qhsafetray.exe
    • sdscan.exe
    • psuaservice.exe