TrojanSpy.Win32.GRANDOREIRO.MLMB

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Mutexe hinzu, damit nur jeweils eine ihrer Kopien ausgeführt wird:

• FA1EA8E940963B9A3B51F33824D877A8

Beendet sich selbst, wenn die folgenden Prozesse im Speicher des betroffenen Systems gefunden werden:

• ResourceHacker.exe
• JoeTrace.exe
• PCHunter32.exe
• PCHunter64.exe
• ProcessHacker.exe
• procexp.exe
• procexp64.exe
• Wireshark.exe
• filemon.exe
• procmon.exe
• regmon.exe

Datendiebstahl

Folgende Daten werden gesammelt:

• System Information:
  • Computername
  • Username
  • Operating System Version
  • IP Address
  • Installed Anti Virus Products
  • Country
  • City
  • Region
  • Zip Code
  • Language
  • Geolocation
  • Time zone information
• Installed Programs:
• Mail Clients
• Microsoft Outlook
• Software\Clients\Mail
• Anti-Malware Program
• C:\Program Files\Trusteer
• C:\Program Files (x86)\Trusteer
• Banking
• C:\Program Files\Diebold\
• C:\Program Files (x86)\Diebold
• C:\Program Files\Topaz OFD
• C:\Program Files (x86)\Topaz OFD
• Crypto Wallets
• c:\Program Files\Bitcoin
• c:\Program Files (x86)\OPOLODesk
• c:\Program Files\OPOLODesk
• c:\Program Files (x86)\BitBox
• c:\Program Files\BitBox
• c:\Program Files (x86)\Coinomi
• c:\Program Files\Coinomi
• c:\Program Files (x86)\Electrum
• c:\Program Files\Electrum
• c:\Program Files (x86)\Binance
• c:\Program Files\Binance
• Connects to the following URL to retrieve affected system's IP Address
• http[:]/ip-api[.]com/json

Andere Details

Es macht Folgendes:

• It terminates itself if any of the following are satisfied:
  • If the execution is occurring in a Virtual Environment
  • If it is executed from the following directory:
    • D:\script
    • D:\programming
  • If the username matches any of the following:
  • JOHN-PC
  • DESTOP2457
  • difusor
  • Win-StephyPC3
  • WIN-VUA6POUV5U
  • WORK
  • *~+
  • Administrator
• It retrieves the hostname from the following URL
  • {BLOCKED}m-az.net
  However as of this writing, the said URL is inaccessible.
• It requires a successful connection to the C&C server to retrieve the URL responsible for downloading the payload.
• Completing the captcha is required to execute the malware's routine.