TrojanSpy.Win32.XWORM.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Führt Befehle eines externen, böswilligen Benutzers aus, wodurch das betroffene System gefährdet wird.

Zeichnet die Tastatureingaben eines Benutzers auf, um Daten zu entwenden.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Dateien ein:

• %Temporary Internet Files%\{Random Numbers}\RegAsm.exe
• %AppDataLocal%\EcoVision Dynamics\EcoScape.js
• If avastui.exe | avgui.exe | nswscsvc.exe | sophoshealth.exe is found running on the system:
  • %Temporary Internet Files%\{Random Numbers}\AutoIt3.exe
  • %Temporary Internet Files%\{Random Numbers}\R.au3
  • %AppDataLocal%\EcoVision Dynamics\A.a3x
  • %AppDataLocal%\EcoVision Dynamics\AutoIt3.exe
  Otherwise:
  • %Temporary Internet Files%\{Random Numbers}\Telecom.pif
  • %Temporary Internet Files%\{Random Numbers}\R
  • %AppDataLocal%\EcoVision Dynamics\A
  • %AppDataLocal%\EcoVision Dynamics\EcoScape.pif
• Sets the attributes to SYSTEM and HIDDEN:
  • %Temporary Internet Files%\Commander
  • %Temporary Internet Files%\Papers
  • %Temporary Internet Files%\Keyboard
  • %Temporary Internet Files%\Plugins
  • %Temporary Internet Files%\Cameras
  • %Temporary Internet Files%\Cutting.bat
  • %Temporary Internet Files%\Friends
  • %Temporary Internet Files%\Northeast
  • %Temporary Internet Files%\Fears
  • %Temporary Internet Files%\Tramadol
  • %Temporary Internet Files%\Stream

Fügt die folgenden Prozesse hinzu:

• "%System%\cmd.exe" /c move Cutting Cutting.bat & Cutting.bat
• tasklist
• findstr /I "wrsa.exe opssvc.exe"
• findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
• cmd /c md {Random Numbers}
• If avastui.exe | avgui.exe | nswscsvc.exe | sophoshealth.exe is found running on the system:
  • cmd /c copy /b Northeast + Cameras + Papers + Friends + Fears + Commander + Tramadol + Plugins {Random Numbers}\AutoIt3.exe
  • cmd /c copy /b Stream + Keyboard {Random Numbers}\R.au3
  • {Random Numbers}\AutoIt3.exe {Random Numbers}\R.au3
  Otherwise:
  • cmd /c copy /b Northeast + Cameras + Papers + Friends + Fears + Commander + Tramadol + Plugins {Random Numbers}\Telecom.pif
  • cmd /c copy /b Stream + Keyboard {Random Numbers}\R
  • {Random Numbers}\Telecom.pif {Random Numbers}\R
• If wrsa.exe | opssvc.exe is found running on the system:
  • ping -n 199 127.0.0.1
  Otherwise:
  • ping -n 5 127.0.0.1
• schtasks.exe /create /tn "Impaired" /tr "wscript //B '%AppDataLocal%\EcoVision Dynamics\EcoScape.js'" /sc minute /mo 3 /F

(Hinweis: %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) and 10(64-bit).)

Erstellt die folgenden Ordner:

• %AppDataLocal%\EcoVision Dynamics
• %Temporary Internet Files%\{Random Numbers}

Fügt die folgenden Mutexe hinzu, damit nur jeweils eine ihrer Kopien ausgeführt wird:

• 0vyG14tDobaS6ejo

Autostart-Technik

Schleust die folgenden Dateien in den benutzerspezifischen Autostart-Ordner von Windows ein, um sich selbst bei jedem Systemstart auszuführen.

• %User Startup%\EcoScape.url
  • Which contains the following target URL:
    • file:///%AppDataLocal%/EcoVision%20Dynamics/EcoScape.js

Backdoor-Routine

Führt die folgenden Befehle eines externen, böswilligen Benutzers aus:

• pong → Sends a "pong" string to the C2
• rec → Restarts the application
• CLOSE → Closes the application
• uninstall → Executes the uninstall commands
• update → Executes the uninstall commands and the updated binary
• DW → Executes a powershell script
• FM → Executes a command from the C2 in memory
• LN → Downloads a file from a URL and execute it
• Urlopen → Opens a URL through a browser
• Urlhide → Creates a HTTP GET request
• PCShutdown → Executes a shutdown command
• PCRestart → Executes a restart command
• PCLogoff → Executes a logoff command
• RunShell → Executes a command
• StartDDos → Initiates DDoS activities
• StopDDos → Terminates DDoS activities
• StartReport → Sends a list of running processes
• StopReport → Terminates sending of running proccesses list
• Xchat → Sends a "Xchat" string and the ID generated using system information
• Hosts → Sends the drivers\etc\host file contents
• Shosts → Modifies the contents of a file
• DDos → Sends a "DDos" string to the C2
• plugin → Decompresses and executes a plugin
• savePlugin → Saves the decoded plugin to a registry then decompresses and executes it
• RemovePlugins → Deletes the registry with plugin data
• OfflineGet → Sends the contents of the keylogger file
• $cap → Sends a screen capture

Einschleusungsroutine

Schleust die folgenden Dateien ein, die zur Erfassung von Tastatureingaben verwendet werden:

• %AppDataLocal%\Temp\Log.tmp

Datendiebstahl

Folgende Daten werden gesammelt:

• MD5 Hash of the following concatenated data:
  • Processor count
  • Username
  • Machine name
  • OS version
  • Total size of system drive
• Username
• OS Full Name, Version, and Architecture
• Malware's original filename → "ASGARD"
• Malware's last modification date
• True | False → if executed using the filename "USB.exe"
• True | False → if executed with admin rights
• True | False → if camera is present
• CPU Information
• GPU Information
• RAM Information
• Installed Antivirus Information
• Active Window Title

Zeichnet die Tastatureingaben eines Benutzers auf, um Daten zu entwenden.

Entwendete Daten

Sendet die gesammelten Daten über HTTP-POST an den folgenden URL:

• {BLOCKED}.{BLOCKED}.{BLOCKED}.142:8989

Andere Details

Es macht Folgendes:

• It connects to the following URL that contains a text of the C&C server address:
  • https://{BLOCKED}in.com/raw/Dh8E7H3R