TrojanSpy.Win64.STEALDEAL.C

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy drops the following files:

• %User Temp%\{Compromised browser}\Administrator#History.csv
• %User Temp%\{Compromised browser}\Administrator#LoginData.csv
• %User Temp%\Microsoft Edge\SS_ErrorLog.txt
• %User Temp%\Mozilla Firefox\SS_ErrorLog.txt
• %User Temp%\Yandex Browser\SS_ErrorLog.txt
• %User Temp%\Chromium\SS_ErrorLog.txt
• %User Temp%\Chrome Beta\SS_ErrorLog.txt
• %User Temp%\Google Chrome\S_ErrorLog.txt
• %AppDataLocal%\{Compromised browser}\User Data\Default\History_copy_
• %AppDataLocal%\{Compromised browser}\User Data\Default\Login Data_copy_
• %AppDataLocal%\{Compromised browser}\User Data\Default\Web Data_copy_

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Information Theft

This Trojan Spy gathers the following data:

• Stored credentials, history, and etc. from the following browsers:
  • Google Chrome
  • Microsoft Edge
  • Mozilla Firefox
  • Chromium
  • Chrome Beta
  • Yandex Browser
• Information related to installed mailed clients
  • HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\User\{User ID}