Trojan.PS1.XAMALA.B

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Beendet sich selbst, wenn die folgenden Prozesse im Speicher des betroffenen Systems gefunden werden:

• "fshoster*"
• "fsorsp*"
• "avp*"
• "xagt*"
• "360sd*"
• "360Safe*"
• "ovcd*"
• "dwengine*"

Datendiebstahl

Folgende Daten werden gesammelt:

• Username
• Running Process Name
• Parent Process Name
• 32-bit or 64-bit machine
• User Profile

Andere Details

Es macht Folgendes:

• Checks for the presence of the following strings on each item and terminates itself if any is found:
  • Services
    • "fshoster*"
    • "dr.web*"
    • "Bitdefender*"
    • "xagt*"
    • "360rp*"
    • "ZhuDongFangYu*"
    • "zabbix*"
    • "BGS_SDService*"
    • "NAGIOS*"
    • "OvCtrl*"
    • "EUM*"
    • "SolarWindsAgent*"
    • "APPOPTICS*"
    • "Anturis*"
    • "QualysAgent*"
  • Service Display Name
    • "*dr.web*"
    • "*F-Secure*"
    • "*Bitdefender*"
    • "*FireEye*"
    • "*zabbix*"
    • "*BGS_SDService*"
    • "*NAGIOS*"
    • "*OpenView*"
    • "*ManageEngine*Monitoring*"
    • "*APPOPTICS*"
    • "*Anturis*"
• However, the C&C server is not defined within the file. It may be defined by other components and/or by malicious actors before execution in order to proceed with its intended routine.
• It may download a possibly malicious file