TSPY_DARKTHI.A

This Trojan Spy arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to a website to send and receive information.

It steals certain information from the system and/or the user.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This Trojan Spy arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy adds the following mutexes to ensure that only one of its copies runs at any one time:

• {Infected Machine GUID}

Backdoor Routine

This Trojan Spy connects to the following websites to send and receive information:

• http://a{BLOCKED}-master.net/getcfg={Encoded Infected Machine GUID} ← Will be used as marker/identifier of the infected machine for the C2 communication

Information Theft

This Trojan Spy steals the following information:

• Account Information/Credentials from the following Instant Messaging applications:
  • PidGin
  • PsiPlus
  • Telegram
• It attempts to steal stored account information used in the following installed File Transfer Protocol (FTP) clients or file manager software:
  • FileZilla
  • WinSCP
• It attempts to steal stored email credentials from the following:
  • InternetMailRu
  • Microsoft Outlook
  • Thunderbird
• It attempts to get stored information such as user names, passwords, and host names from the following browsers:
  • 7Star
  • 360Browser
  • Amigo (Russian Browser)
  • Brave
  • Bromium
  • CentBrowser
  • Chedot
  • Chrome/Chromium
  • CocCoc (Vietnam Browser)
  • Comodo Dragon Browser
  • ElementsBrowser
  • Epic
  • Firefox
  • GoBrowser
  • Internet Explorer/Edge
  • Kometa
  • Mustang
  • Nichrome
  • Opera
  • Orbitum
  • QIPSurf
  • RockMelt
  • SaferBrowser
  • Sputnik
  • Suhba
  • Superbird
  • Thunderbird
  • TorBro
  • Torch
  • Uran
  • Vivaldi
  • Yandex Browser
• Stored Password in SQL Database
• It attempts to steal bitcoin wallet information with the following list of specific bitcoin wallet:
  • MultiBitHD
  • Electrum
  • Monero
  • Bitcoin Core
• Skype Message History
• Browser Cookies
• Autocomplete Data on Browsers
• Files with specific extensions from %Desktop%
• Steam Account Information
• Username
• Computer Name
• List of installed programs
• List of running processes
• OS information
• RAM information
• IP Address

(Note: %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Stolen Information

This Trojan Spy sends the gathered information via HTTP POST to the following URL:

• http://a{BLOCKED}-master.net/repac.php

Other Details

This Trojan Spy does the following:

• It deletes itself by executing the following commands:
  • cmd /c timeout 1 & del "{Malware Directory}\{Malware File Name}.exe"

However, as of this writing, the said sites are inaccessible.