Backdoor.Win32.PIKABOT.C

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Prozesse hinzu:

• %System%\SearchProtocolHost.exe → legitimate executable where it will inject the Pikabot core module
• whoami.exe /all
• ipconfig.exe /all
• netstat.exe -aon

(Hinweis: %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) and 10(64-bit).)

Fügt die folgenden Mutexe hinzu, damit nur jeweils eine ihrer Kopien ausgeführt wird:

• {A77FC435-31B6-4687-902D-24153579C738}

Datendiebstahl

Folgende Daten werden gesammelt:

• OS Version
• Build Number
• Product Number
• User Name
• Computer Name
• CPU Name
• System Uptime
• GPU Name
• RAM Amount
• Screen Resolution
• Domain Controller Name
• Domain Controller Address
• Network Information
• User/Groups Information
• Running Processes

Entwendete Daten

Sendet die gesammelten Daten über HTTP-POST an den folgenden URL:

• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.55:2225/cervicobrachial/oIP7xH86DZ6hb?vermixUnintermixed=beatersVerdigrisy&backoff=9zFPSr
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.25:2967/cervicobrachial/oIP7xH86DZ6hb?vermixUnintermixed=beatersVerdigrisy&backoff=9zFPSr
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.01:13720/cervicobrachial/oIP7xH86DZ6hb?vermixUnintermixed=beatersVerdigrisy&backoff=9zFPSr
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.100:13721/cervicobrachial/oIP7xH86DZ6hb?vermixUnintermixed=beatersVerdigrisy&backoff=9zFPSr
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.139:2222/cervicobrachial/oIP7xH86DZ6hb?vermixUnintermixed=beatersVerdigrisy&backoff=9zFPSr
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.156:2078/cervicobrachial/oIP7xH86DZ6hb?vermixUnintermixed=beatersVerdigrisy&backoff=9zFPSr
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.190:2223/cervicobrachial/oIP7xH86DZ6hb?vermixUnintermixed=beatersVerdigrisy&backoff=9zFPSr

Andere Details

Es macht Folgendes:

• After sending the gathered information, the malware's behavior will depend on the response of the C&C server. However, as of this writing, the said sites are inaccessible
• It checks if the following virtual machine, sandbox, or security program related module(s) is loaded in the affected system:
  • cmdvrt.32.dll
  • cmdvrt.64.dll
  • dbghelp.dll
  • cuckoomon.dll
  • pstorec.dll
  • avghookx.dll
  • avghooka.dll
  • snxhk.dll
  • api_log.dll
  • dir_watch.dll
  • wpespy.dll
  • kernel32.dll
  • networkexplorer.dll
  • NlsData0000.dll
  • NetProjW.dll
  • Ghofr.dll
  • fg122.dll
• It terminates if the system default language is one of the following:
  • Russian
  • Ukrainian