TrojanSpy.MSIL.LUMMAC.C

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Verbindet sich mit einer bestimmten Website, um Daten zu versenden und zu empfangen.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Prozesse hinzu:

• "%Windows%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

(Hinweis: %Windows% ist der Windows Ordner, normalerweise C:\Windows oder C:\WINNT.)

Injiziert Code in die folgenden Prozesse:

• RegAsm.exe

Datendiebstahl

Folgende Daten werden gesammelt:

• Computer Name
• OS Information
• CPU Information
• Screen Resolution
• System Language
• Physical Memory Installed

Entwendete Daten

Sendet die gesammelten Daten über HTTP-POST an den folgenden URL:

• http://{BLOCKED}c-node.io/c2sock
• http://{BLOCKED}fe.xyz/c2sock

Andere Details

Verbindet sich mit der folgenden Website, um Daten zu versenden und zu empfangen:

• http://{BLOCKED|c-node.io/c2conf
• http://{BLOCKED}fe.xyz/c2conf

Es macht Folgendes:

• It has the following capabilities:
  • Loader function (Execute/Load downloaded executables or DLL files)
  • Execute PowerShell script
  • Manage files (Upload/Download files from server)
  • Manage processes (Create list)
  • Delete itself after execution
• It exfiltrates the following data from Google Chrome.
  • History
  • Login Data
  • Login Data For Account
  • Web Data
  • Network\Cookies
  • Local Storage\leveldb
  • Local Storage\leveldb
• It exfiltrates the following data from Mozilla Firefox.
  • %appdata%\Mozilla\Firefox\Profiles
  • key4.db
  • cert9.db
  • formhistory.sqlite
  • cookies.sqlite
  • logins.json
  • places.sqlite
• It exfiltrates data from the following appilication.
  • AnyDesk
    • .conf
    • %appdata%\AnyDesk
  • FileZilla
    • recentservers.xml
    • sitemanager.xml
  • KeePass
    • .kbdx
  • Steam
    • ssfn*
    • %programfiles%\Steam\config
  • Telegram
    • s*
• It exfiltrates User Data found on the following Browsers.
  • Chrome
  • Chromium
  • Edge
  • Kometa
  • Opera Stable
  • Opera GX Stable
  • Opera Neon
  • Brave Software
  • Comodo
  • CocCoc
• It exfiltrates data on the following crypto wallets.
  • Binance
  • Electrum
  • Ethereum
  • Exodus
  • Ledger Live
  • Atomic
  • Coinomi
  • Authy Desktop
  • Bitcoin core
  • JAXX New Version
• It exfiltrates data found on the following mail client applications.
  • Windows Mail
    • %localappdata%\Microsoft\Windows Mail\Local Folders
    • .eml
  • The Bat!
    • %localappdata%\The Bat!
    • Mail Clients\The Bat\Local
    • .TBB
    • .TBN
    • .MSG
    • .EML
    • .MSB
    • .mbox
    • .ABD
    • .FLX
    • .TBK
    • .HBI
  • Thunderbird
    • %appdata%\Thunderbird\Profiles
  • PMAIL
    • .CNM
    • .PMF
    • .PMN
    • .PML
    • CACHE.PM
    • .WPM
    • .PM
    • .USR
  • Mailbird
    • Mail Clients\Mailbird
    • \MessageIndex
    • .db
  • eM Client
    • .dat
    • .dat-shm
    • .dat-wal
• It exfiltrates crypto currency browser wallet extensions and 2FA applications.