TrojanSpy.Win64.FAUXPERSKY.AC

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain websites to send and receive information.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy adds the following processes:

• %System%\cmd.exe /c ping -n 1 -w 1000 www.google.com.my>Ping.sb → checks internet connection

Other System Modifications

This Trojan Spy deletes the following files:

• {Malware File Path}\Log.txt → to clear contents for new data

Information Theft

This Trojan Spy gathers the following data:

• OS Version
• Computer Name
• User Name
• IP Address
• Content:
  • Keylogging information stored in Log.txt

Other Details

This Trojan Spy connects to the following URL(s) to check for an Internet connection:

• www.google.com.my

It connects to the following website to send and receive information:

• https://{BLOCKED}s.{BLOCKED}e.com/forms/d/e/1FAIpQLSe6oGStKSshScVonAyCVFOrhANSfnmm0Im-aabnBX5ZjLabbA/viewform?entry.930994914=%A_OSVersion%&entry.210885477=%A_ComputerName%&entry.429054695=%A_UserName%&entry.1539630660=%A_IPAddress1%

It requires the existence of the following files to properly run:

• {Malware File Path}\Log.txt → dropped by svhost.exe detected as TrojanSpy.Win64.FAUXPERSKY.AB

It does the following:

• It reads the contents of Log.txt.
• It checks the contents of Ping.sb if it contains the string "could not find."
  • If found, it repeatedly checks for internet connection.
• It exfiltrates information via Google Forms.