TrojanSpy.Win32.INFOSTEALER.THBOCBO

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Dateien ein:

• %All Users Profile%\{random characters}\outlook.txt
• %All Users Profile%\{random characters}\information.txt
• %All Users Profile%\{random characters}\password.txt
• %All Users Profile%\{random characters}\{random characters and numbers}.zip

Fügt die folgenden Prozesse hinzu:

• C:\Windows\System32\cmd.exe" /c taskkill /im {Malware Name}.exe /f & erase {Malware Path}\{Malware Name}.exe & exit;

Download-Routine

Speichert die heruntergeladenen Dateien unter den folgenden Namen:

• %All Users Profile%\freebl3.dll
• %All Users Profile%\mozglue.dll
• %All Users Profile%\msvcp140.dll
• %All Users Profile%\nss3.dll
• %All Users Profile%\softokn3.dll
• %All Users Profile%\vcruntime140.dll

Datendiebstahl

Folgende Daten werden gesammelt:

• Outlook Credentials
• Passwords
• Version
• Date
• Machine ID
• GUID
• Path
• Work Dir
• OS
• Computer Name
• User Name
• Display Resolution
• Display Language
• Keyboard Language
• Timezone
• Processor
• CPU Count
• RAM
• Video Card
• IP
• Location
• ISP
• Running Process in the system
• Installed Programs

Entwendete Daten

Sendet die gesammelten Daten über HTTP-POST an den folgenden URL:

• {BLOCKED}imals.net - send the zip file that contains all data gathered