TrojanSpy.Win32.EMOTET.TIABOFEF

Verbindet sich mit einer bestimmten Website, um Daten zu versenden und zu empfangen. Löscht sich nach der Ausführung selbst.

Installation

Fügt die folgenden Ordner hinzu:

• %AppDataLocal%\{string1}{string2} → if run without admin privileges

Schleust die folgenden Eigenkopien in das betroffene System ein:

• %System%\{string1}{string2}.exe → if run with admin privileges
• %AppDataLocal%\{string1}{string2}\{string1}{string2}.exe → if run without admin privileges
  where {string1} and {string2} can be any of the following strings:
  • term
  • with
  • poller
  • indiana
  • shader
  • sti
  • dlgs
  • metered
  • asptlb
  • conman
  • plain
  • while
  • cpl
  • crash
  • teapot
  • device
  • adam
  • battery
  • trouble
  • caching
  • hand
  • hlf
  • hero
  • smc
  • readand
  • cpls
  • network
  • engn
  • mmc
  • lcl
  • pdh
  • clw
  • vista
  • client
  • pairs
  • fsi
  • medium
  • pdeft
  • known
  • reach
  • vert
  • boost
  • snd
  • fwk
  • builder
  • iab
  • mscms
  • ssp
  • cable
  • etw
  • angle
  • ordered
  • scalar
  • songs
  • ctnt
  • server
  • chinese
  • media
  • endif
  • supp
  • setthe
  • misc
  • diagram
  • urd

(Hinweis: %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) and 10(64-bit).)

Fügt die folgenden Prozesse hinzu:

• {Malware File Path}\{Malware File Name}.exe --{8 Random Characters}
• %System%\{string1}{string2}.exe → if run with admin privileges
• %System%\{string1}{string2}.exe --{8 Random Characters} → if run with admin privileges
• %AppDataLocal%\{string1}{string2}\{string1}{string2}.exe → if run without admin privileges
• %AppDataLocal%\{string1}{string2}\{string1}{string2}.exe --{8 Random Characters} → if run without admin privileges

(Hinweis: %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) and 10(64-bit).)

Fügt die folgenden Mutexe hinzu, damit nur jeweils eine ihrer Kopien ausgeführt wird:

• Global\I{Volume Serial Number}
• Global\M{Volume Serial Number}

Autostart-Technik

Registriert sich als Systemdienst, damit sie bei jedem Systemstart automatisch ausgeführt wird, indem sie die folgenden Registrierungseinträge hinzufügt:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\{string1}{string2}
ImagePath = %System%\{string1}{string2}.exe

Fügt folgende Registrierungseinträge hinzu, um bei jedem Systemstart automatisch ausgeführt zu werden.

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{string1}{string2} = "%AppDataLocal%\{string1}{string2}\{string1}{string2}.exe"

Andere Systemänderungen

Fügt die folgenden Registrierungsschlüssel hinzu:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{string1}{string2}

Fügt die folgenden Registrierungseinträge hinzu:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{string1}{string2}
Type = 16

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{string1}{string2}
Start = 2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{string1}{string2}
ErrorControl = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{string1}{string2}
DisplayName = {string1}{string2}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{string1}{string2}
ObjectName = {string1}{string2}

Datendiebstahl

Folgende Daten werden gesammelt:

• Computer Name
• Process SessionId
• OS Version
• Running Processes
• File CRC
• Processor Architecture

Andere Details

Verbindet sich mit der folgenden Website, um Daten zu versenden und zu empfangen:

• • {BLOCKED}.{BLOCKED}.71.206:7080/{string}
  • {BLOCKED}.{BLOCKED}.183.28:8080/{string}
  • {BLOCKED}.{BLOCKED}.93.124:7080/{string}
  • {BLOCKED}.{BLOCKED}.215.57:7080/{string}
  • {BLOCKED}.{BLOCKED}.163.19:8090/{string}
  • {BLOCKED}.{BLOCKED}.124.145:443/{string}
  • {BLOCKED}.{BLOCKED}.77.40:7080/{string}
  • {BLOCKED}.{BLOCKED}.{BLOCKED}.121:80/{string}
  • {BLOCKED}.{BLOCKED}.166.147:80/{string}
  • {BLOCKED}.{BLOCKED}.15.205:8080/{string}
  • {BLOCKED}.{BLOCKED}.140.14:443/{string}
  • {BLOCKED}.{BLOCKED}.87.122:8080/{string}
  • {BLOCKED}.{BLOCKED}.182.254:8080/{string}
  • {BLOCKED}.{BLOCKED}.57.43:80/{string}
  • {BLOCKED}.{BLOCKED}.211.77:8080/{string}
  • {BLOCKED}.{BLOCKED}.101.134:8080/{string}
  • {BLOCKED}.{BLOCKED}.33.84:8080/{string}
  • {BLOCKED}.{BLOCKED}.190.199:8080/{string}
  • {BLOCKED}.{BLOCKED}.170.114:8080/{string}
  • {BLOCKED}.{BLOCKED}.160.178:8080/{string}
  • {BLOCKED}.{BLOCKED}.143.100:7080/{string}
  • {BLOCKED}.{BLOCKED}.8.192:8080/{string}
  • {BLOCKED}.{BLOCKED}.51.143:8080/{string}
  • {BLOCKED}.{BLOCKED}.35.138:7080/{string}
  • {BLOCKED}.{BLOCKED}.151.103:8080/{string}
  • {BLOCKED}.{BLOCKED}.183.211:8080/{string}
  • {BLOCKED}.{BLOCKED}.111.142:7080/{string}
  • {BLOCKED}.{BLOCKED}.144.228:80/{string}
  • {BLOCKED}.{BLOCKED}.212.195:8080/{string}
  • {BLOCKED}.{BLOCKED}.95.107:443/{string}
  • {BLOCKED}.{BLOCKED}.115.217:8080/{string}
  • {BLOCKED}.{BLOCKED}.38.226:50000/{string}
  • {BLOCKED}.{BLOCKED}.160.224:8080/{string}
  • {BLOCKED}.{BLOCKED}.237.140:8080/{string}
  • {BLOCKED}.{BLOCKED}.159.3:8080/{string}
  • {BLOCKED}.{BLOCKED}.32.59:80/{string}
  • {BLOCKED}.{BLOCKED}.41.228:990/{string}
  • {BLOCKED}.{BLOCKED}.74.202:443/{string}
  • {BLOCKED}.{BLOCKED}.32.171:80/{string}
  • {BLOCKED}.{BLOCKED}.83.179:80/{string}
  • {BLOCKED}.{BLOCKED}.171.51:80/{string}
  • {BLOCKED}.{BLOCKED}.102.71:8443/{string}
  • {BLOCKED}.{BLOCKED}.227.135:80/{string}
  • {BLOCKED}.{BLOCKED}.106.18:80/{string}
  • {BLOCKED}.{BLOCKED}.106.18:80/{string}
  • {BLOCKED}.{BLOCKED}.30.167:990/{string}
  • {BLOCKED}.{BLOCKED}.152.186:8080/{string}
  • {BLOCKED}.{BLOCKED}.14.52:80/{string}
  • {BLOCKED}.{BLOCKED}.60.129:8080/{string}
  • {BLOCKED}.{BLOCKED}.60.129:80/{string}
  • {BLOCKED}.{BLOCKED}.60.129:80/{string}
  • {BLOCKED}.{BLOCKED}.131.105:8080/{string}
  • {BLOCKED}.{BLOCKED}.104.21:443/{string}
  • {BLOCKED}.{BLOCKED}.253.234:990/{string}
  • {BLOCKED}.{BLOCKED}.194.42:8080/{string}
  • {BLOCKED}.{BLOCKED}.21.214:443/{string}
  • {BLOCKED}.{BLOCKED}.89.61:50000/{string}
  • {BLOCKED}.{BLOCKED}.11.143:8080/{string}
  • {BLOCKED}.{BLOCKED}.141.218:80/{string}
  • {BLOCKED}.{BLOCKED}.132.93:990/{string}
  • {BLOCKED}.{BLOCKED}.41.111:443/{string}
  • {BLOCKED}.{BLOCKED}.95.172:80/{string}
  • {BLOCKED}.{BLOCKED}.148.222:8080/{string}
  • {BLOCKED}.{BLOCKED}.198.10:8080/{string}
  • {BLOCKED}.{BLOCKED}.97.25:80/{string}
  • {BLOCKED}.{BLOCKED}.253.20:21/{string}
  • {BLOCKED}.{BLOCKED}.166.242:80/{string}
  • {BLOCKED}.{BLOCKED}.122.122:8080/{string}
  • {BLOCKED}.{BLOCKED}.42.205:443/{string}
  • {BLOCKED}.{BLOCKED}.164.248:80/{string}
  • {BLOCKED}.{BLOCKED}.17.210:443/{string}
  • {BLOCKED}.{BLOCKED}.153.203:443/{string}
  • {BLOCKED}.{BLOCKED}.163.131:8080/{string}
  • {BLOCKED}.{BLOCKED}.187.151:8080/{string}
  • {BLOCKED}.{BLOCKED}.204.126:8080/{string}
  • {BLOCKED}.{BLOCKED}.173.247:8080/{string}
  • {BLOCKED}.{BLOCKED}.158.155:80/{string}
  • {BLOCKED}.{BLOCKED}.93.230:80/{string}
  • {BLOCKED}.{BLOCKED}.237.27:443/{string}
  • {BLOCKED}.{BLOCKED}.106.4:7080/{string}
  • {BLOCKED}.{BLOCKED}.124.163:8080/{string}
  • {BLOCKED}.{BLOCKED}.150.176:443/{string}
  • {BLOCKED}.{BLOCKED}.86.13:8080/{string}
  • {BLOCKED}.{BLOCKED}.58.132:8080/{string}
• where {string} can be one or a combination of any of the following strings, separated by "/":
  • teapot
  • pnp
  • tpt
  • splash
  • site
  • codec
  • health
  • balloon
  • cab
  • odbc
  • badge
  • dma
  • psec
  • cookies
  • iplk
  • devices
  • enable
  • mult
  • prov
  • vermont
  • attrib
  • schema
  • iab
  • chunk
  • publish
  • prep
  • srvc
  • sess
  • ringin
  • nsip
  • stubs
  • img
  • add
  • xian
  • jit
  • free
  • pdf
  • loadan
  • arizona
  • tlb
  • forced
  • results
  • symbols
  • report
  • guids
  • taskbar
  • child
  • cone
  • glitch
  • entries
  • between
  • bml
  • usbccid
  • sym
  • enabled
  • merge
  • window
  • scripts
  • raster
  • acquire
  • json
  • rtm
  • walk
  • ban

Löscht sich nach der Ausführung selbst.