TrojanSpy.MSIL.LUMMAC.B

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Diese Malware hat keine Verbreitungsroutine.

Diese Malware hat keine Backdoor-Routine.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Prozesse hinzu:

• %System%\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA== → delays execution for 20 seconds
• {Malware Path}\{Malware File Name}.exe

(Hinweis: %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) and 10(64-bit).)

Verbreitung

Diese Malware hat keine Verbreitungsroutine.

Backdoor-Routine

Diese Malware hat keine Backdoor-Routine.

Datendiebstahl

Folgende Daten werden gesammelt:

• Malware Build Number
• Malware ID
• HWID
• Screen Resolution
• Language
• Computer Name
• Physical Memory Installed

Entwendete Daten

Sendet die gesammelten Daten über HTTP-POST an den folgenden URL:

• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.247/c2sock

Andere Details

Es macht Folgendes:

• It exfiltrates the following data from Google Chrome.
  • History
  • Login Data
  • Login Data For Account
  • Web Data
  • Network\Cookies
  • Local Storage\leveldb
  • Local Storage\leveldb
• It exfiltrates the following data from Mozilla Firefox.
  • %appdata%\Mozilla\Firefox\Profiles
  • key4.db
  • cert9.db
  • formhistory.sqlite
  • cookies.sqlite
  • logins.json
  • places.sqlite
• It exfiltrates data from the following appilication.
  • AnyDesk
    • .conf
    • %appdata%\AnyDesk
  • FileZilla
    • recentservers.xml
    • sitemanager.xml
  • KeePass
    • .kbdx
  • Steam
    • ssfn*
    • %programfiles%\Steam\config
  • Telegram
    • s*
• It exfiltrates User Data found on the following Browsers.
  • Chrome
  • Chromium
  • Edge
  • Kometa
  • Opera Stable
  • Opera GX Stable
  • Opera Neon
  • Brave Software
  • Comodo
  • CocCoc
• It exfiltrates data on the following crypto wallets.
  • Binance
  • Electrum
  • Ethereum
  • Exodus
  • Ledger Live
  • Atomic
  • Coinomi
  • Authy Desktop
  • Bitcoin core
  • JAXX New Version
• It exfiltrates data found on the following mail client applications.
  • Windows Mail
    • %localappdata%\Microsoft\Windows Mail\Local Folders
    • .eml
  • The Bat!
    • %localappdata%\The Bat!
    • Mail Clients\The Bat\Local
    • .TBB
    • .TBN
    • .MSG
    • .EML
    • .MSB
    • .mbox
    • .ABD
    • .FLX
    • .TBK
    • .HBI
  • Thunderbird
    • %appdata%\Thunderbird\Profiles
  • PMAIL
    • .CNM
    • .PMF
    • .PMN
    • .PML
    • CACHE.PM
    • .WPM
    • .PM
    • .USR
  • Mailbird
    • Mail Clients\Mailbird
    • \MessageIndex
    • .db
  • eM Client
    • .dat
    • .dat-shm
    • .dat-wal
• It exfiltrates the following Browser wallet extensions and 2FA appilications.
  • MetaMask
    • ejbalbakoplchlghecdalmeeeajnimhm
    • nkbihfbeogaeaoehlefnkodbefgpgknn
  • TronLink
    • ibnejdfjmmkpcnlpebklmnkoeoihofec
  • Ronin Wallet
    • fnjhmkhhmkbjkkabndcnnogagogbneec
  • Binance Chain Wallet
    • fhbohimaelbohpjbbldcngcnapndodjp
  • Yoroi
    • ffnbelfdoeiohenkjibnmadjiehjhajb
  • Nifty
    • jbdaocneiiinmjbjlgalhcelgbejmnid
  • Math
    • afbcbjpbpfadlkmhmclhkeeodmamcflc
  • Coinbase
    • hnfanknocfeofbddgcijnmhnfnkdnaad
  • Guarda
    • hpglfhgfnhbgpjdenjgmdgoeiappafln
  • EQUAL
    • blnieiiffboillknjnepogjhkgnoapac
  • Jaxx Liberty
    • cjelfplplebdjjenllpjcblmjkfcffne
  • BitApp
    • fihkakfobkmkjojpchpfgcmhfjnmnfpi
  • iWlt
    • kncchdigobghenbbaddojjnnaogfppfj
  • EnKrypt
    • kkpllkodjeloidieedojogacfhpaihoh
  • Wombat
    • amkmjjmmflddogmhpjloimipbofnfjih
  • MEW CX
    • nlbmnnijcnlegkjjpcfjclmcfggfefdm
  • Guild
    • nanjmdknhkinifnkgdcggcfnhdaammmj
  • Saturn
    • nkddgncdjgjfcddamfgcmfnlhccnimig
  • NeoLine
    • cphhlgmgameodnhkjdmkpanlelnlohao
  • Clover
    • nhnkbkgjikgcigadomkphalanndcapjk
  • Liquality
    • kpfopkelmapcoipemfendmdcghnegimn
  • Terra Station
    • aiifbnbfobpmeekipheeijimdpnlpgpp
  • Keplr
    • dmkamcknogkgcdfhhbddcghachkejeap
  • Sollet
    • fhmfendgdocmcbmfikdcogofphimnkno
  • Auro
    • cnmamaachppnkjgnildpdmkaakejnhae
  • Polymesh
    • jojhfeoedkpkglbfimdfabpdfjaoolaf
  • ICONex
    • flpiciilemghbmfalicajoolhkkenfel
  • Nabox
    • nknhiehlklippafakaeklbeglecifhad
  • KHC
    • hcflpincpppdclinealmandijcmnkbgn
  • Temple
    • ookjlbkiijinhpmnjffcofjonbfbgaoc
  • TezBox
    • mnfifefkajgofkcjkemidiaecocnkjeh
  • DAppPlay
    • lodccjjbdhfakaekdiahmedfbieldgik
  • BitClip
    • ijmpgkjfkbfhoebgogflfebnmejmfbml
  • Steem Keychain
    • lkcjlnjfpbikmcmbachjpdbijejflpcm
  • Nash Extension
    • onofpnbbkehpmmoabgpcpmigafmmnjhl
  • Hycon Lite Client
    • bcopgchhojmggmffilplmbdicgaihlkp
  • ZilPay
    • klnaejjgbibmhlephnhpmaofohgkpgkd
  • Coin98
    • aeachknmefphepccionboohckonoeemg
  • Authenticator
    • bhghoamapcdpbohphigoooaddinpkbai
  • Cyano
    • dkdedlpgdmmkkfjabffeganieamfklkm
  • Byone
    • nlgbhdfgdhgbiamfdfmbikcdghidoadd
  • OneKey
    • infeboajgfhgbjpjbeppbkgnabfdkdaf
  • Leaf
    • cihmoadaighcejopammfbmddcmdekcje
  • Authy
    • gaedmjdfmmahhbjefcbgaolhhanlaolb
  • EOS Authenticator
    • oeljdldpnmdbchonielidgobddffflal
  • GAuth Authenticator
    • ilgcnhelpchnceeipipijaljkblbcobl
  • Trezor Password Manager
    • imloifkgjagghnncjkhggdhalmcnfklk
  • Phantom
    • bfnaelmomeimhlpmgjnjophhpkkoljpa
• It has a capability to delete itself after execution.