TrojanSpy.Win32.GRANDOREIRO.MLMA

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Mutexe hinzu, damit nur jeweils eine ihrer Kopien ausgeführt wird:

• IntelWassing39

Beendet sich selbst, wenn die folgenden Prozesse im Speicher des betroffenen Systems gefunden werden:

• regmon.exe
• filemon.exe
• Wireshark.exe
• ProcessHacker.exe
• PCHunter64.exe
• PCHunter32.exe
• JoeTrace.exe
• ResourceHacker.exe

Datendiebstahl

Folgende Daten werden gesammelt:

• Username
• Computer Name
• System Information
• OS Name and Version
• Hostname
• Geolocation
• IP Address
• List of Installed Applications
• List of Installed Antivirus
• Date and Time of Execution

Andere Details

Es macht Folgendes:

• It compares the country code of the affected system before proceeding to its original routine to the following targeted countries:
  • GT - Guatemala
  • HN - Honduras
  • MX - Mexico
  • NI - Nicaragua
  • PA - Panama
  • SV - El Salvador
  • AR - Argentina
  • BO - Bolivia
  • BR - Brazil
  • EC - Ecuador
  • PE - Peru
  • PY - Paraguay
  • UY - Uruguay
  • VE - Venezuela
  • BB - Barbados
  • BS - Bahamas
  • DO - Dominican Republic
  • HT - Haiti
  • JM - Jamaica
  • KY - Cayman Islands
  • CH - Switzerland
  • IT - Italy
  • PL - Poland
  • UK - United Kingdom
  • FR - France
  • ES - Spain
  • IE - Ireland
• It compares the Hostname of the affected system before proceeding to its original routine to the following:
  • WIN-VUA6POUV5UP
  • JOHN-PC
  • WORK
• It compares the OS Name of the affected system before proceeding to its original routine to the following:
  • Windows XP
  • Windows Vista
  • Windows 7
  • Windows 8
  • Windows 10
  • Windows 11
• This Trojan Spy connects to the following URL(s) to get the affected system's IP address:
  • http://{BLOCKED}i.com/json
• It uses Domain Genaration Algorithm (DGA) to generate its C2 Server.
• It has keylogging capabilities.
• It steals information from the following applications if found in the affected system:
  • Mail Client:
    • Microsoft Outlook
    • Software\Clients\Mail
  • Banking:
    • ACB Carribean
    • Alliance Bank
    • Allied Bank
    • Atlantic Bank
    • Banco BISA
    • Banco Unión
    • Banco de Crédito
    • Banco Nacional
    • Banco Económico
    • Banco Ganadero
    • BNamericas
    • Banco Los Andes
    • Banco Mercantil
    • Banca por Internet
    • BMSC
    • BancoSol
    • Bank of Valletta
    • BBVA
    • Belize Bank
    • Butterfield Group
    • Caja de Ahorros
    • Choice Bank
    • CIBC
    • CIBC First Carribean
    • Citibank
    • Credit Suisse
    • Davivienda
    • Doral Bank
    • e-Bandes
    • e-Bisa
    • FIMBank
    • HRCU Online Account
    • HSBC Malta
    • IIG Bank
    • Inicio
    • FISE
    • MEXC Exchange
    • Orco Bank
    • Provincia Casa Financiera
    • Raiffeisen-Gruppe
    • Republic Bank
    • RepublicOnline Corporate
    • Santander
    • Scotia Bank
    • Synchrony Bank
    • UBS E-Banking
  • Stocks:
    • Fortex
  • Cryptocurrency Wallet:
    • Armory
    • Atomic Wallet
    • Binance
    • Bisq
    • Bitbox
    • Bither
    • Blockstream
    • BTC-CORE
    • Coinomi
    • Daedalus
    • Electrum
    • Hotbit Global
    • Ledger
    • Monero
    • OPOLODesk
    • Trezor
    • Trust Wallet
    • WasabiWallet