TrojanSpy.Win32.FAKECHRO.A

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be dropped by other malware.

It does not have any propagation routine.

It does not have any backdoor routine.

It logs a user's keystrokes to steal information.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be dropped by the following malware:

• Trojan.Win32.FAKEFOLDR.AMM

Installation

This Trojan Spy adds the following processes:

• reg.exe add HKLM\SOFTWARE\Policies\Google\Chrome /v IncognitoModeAvailability /d 1 /t REG_DWORD /f
• chromeold.exe --load-extension=%ProgramData%\f16e678e0faed084c70405f14d47bc38

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit), XP.)

Other System Modifications

This Trojan Spy deletes the following files:

• %AppDataLocal%\Google\Chrome\User Data\Default\Cookies
• %AppDataLocal%\Google\Chrome\User Data\Default\Preferences

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Google\Chrome
IncognitoModeAvailability = 1

(Note: The default value data of the said registry entry is 0.)

Propagation

This Trojan Spy does not have any propagation routine.

Backdoor Routine

This Trojan Spy does not have any backdoor routine.

Rootkit Capabilities

This Trojan Spy does not have rootkit capabilities.

Information Theft

This Trojan Spy attempts to get stored information such as user names, passwords, and hostnames from the following browsers:

• Google Chrome

It logs a user's keystrokes to steal information.

Drop Points

Stolen information is uploaded to the following websites:

• http://{BLOCKED}jlcg.x10.bz/{BLOCKED}VjdG9y.php?dXJs={HostName}&cGF0aA={malware directory}&ZGF0YQ={Stolen Information}

Other Details

This Trojan Spy does not exploit any vulnerability.