TrojanSpy.Win64.GARYSTEAL.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Führt Befehle eines externen, böswilligen Benutzers aus, wodurch das betroffene System gefährdet wird.

Verbindet sich mit einer bestimmten Website, um Daten zu versenden und zu empfangen.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Zeigt die folgenden gefälschten Fehlermeldungen an:

Backdoor-Routine

Führt die folgenden Befehle eines externen, böswilligen Benutzers aus:

• Create startup persistence
• Perform stealer capabilities
• Execute arbitrary commands
• Display alert messages
• Retrieve running processes
• Execute files on disk or in memory
• Access and write to the clipboard
• Perform a random task
• Download and execute additional payloads
• Terminate itself
• Delete itself

Datendiebstahl

Folgende Daten werden gesammelt:

• Host information
• Access privilege level
• OS information
• Network information
• Browser data
• Cryptocurrency wallet data

Andere Details

Verbindet sich mit der folgenden Website, um Daten zu versenden und zu empfangen:

• {BLOCKED}.ngrok.io:18560

Es macht Folgendes:

• It sends an HTTP GET request to the following URL as a build validator:
  • http://{BLOCKED}grok.io:18560/api/v1/bulla/?id=cln0hnnun0000rxwn99y3ueza&data={Encrypted Unix Time}
• It checks if the following virtual machine- or sandbox-related MAC addresses are present in the affected system:
  • 00:1C:42
  • 08:00:27
  • 00:05:69
  • 00:0C:29
  • 00:1C:14
  • 00:50:56
  • 00:16:E3
• It performs random tasks once it detects virtual machine- or sandbox-related indicators are present in the affected machine:
  • Send a ping to google.com:80
  • Create a config file: %User Profile%\config.ini
  • List files found on the %User Profile% directory
  • List local IP addresses
  • Send an HTTP GET request to https://www.web3api.com
  • Print a random number
  • Create a randomly named folder: %User Profile%\{Random Characters}.txt
  • Print a random string