TrojanSpy.MSIL.EXMATTER.C

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Prozesse hinzu:

• "%System%\WindowsPowerShell\v1.0\powershell.exe" -C "Stop-Process -Id {Process ID}; Start-Sleep 3; Set-Content -Path '{Malware Folder}\{Malware Filename}' -Value 0" → "melt function" after successful execution it executes a powershell script to overwrite itself leaving a 0 value

(Hinweis: %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) and 10(64-bit).)

Fügt die folgenden Mutexe hinzu, damit nur jeweils eine ihrer Kopien ausgeführt wird:

• user2user3

Andere Details

Es macht Folgendes:

• It takes ownership of its executable folder and removes all other account’s access
• The files it sends must be from 1 year ago up to 6 years ago from its execution date
• The files it sends must be from 6 months ago up to 10 years from its execution date
• It does not send system files, temporary files, and directories
• It does not send files smaller than 8192 bytes
• It does not send files larger than 67108864 bytes
• It does not send files from the following directories:
• \System Volume Information
• C:\Users\All Users\Microsoft
• C:\ProgramData
• C:\Windows
• C:\$Recycle.Bin
• C:\Documents and Settings
• C:\PerfLogs
• AppData\Roaming\Microsoft
• C:\Program Files (x86)
• AppData\Local\Microsoft
• AppData\Local\Packages
• C:\Program Files
• C:\Program Files (x86)
• It uploads files with the ff. extensions:
• ppt
• doc
• docx
• docm
• xls
• xlsx
• xlsm
• ppt
• pptx
• pptm
• xps
• accdb
• png
• jpg
• jpeg
• txt
• bmp
• rdp
• sql
• sqlite
• db
• json
• msg
• pst
• zip
• rtf
• ipt
• dwg
• Creates a directory at the following URLs where it uploads the files:
• http://{BLOCKED}.{BLOCKED}.41.58/data
• {BLOCKED}.{BLOCKED}.41.58 → uploads files via SFTP with predefined credentials