Trojan.HTML.WEBWHATS.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Agrega los procesos siguientes:

• %System%\conhost.exe %COMSpeC% ࿐ /V/D/c "mD C:\If1ZR8Y\>nul 2>&1 &&S^eT QFEU=C:\If1ZR8Y\^If1ZR8Y.^jS&&echo var IBUM='Hts+DHts+EHts+" → creates directory without any message

Crea las carpetas siguientes:

• C:\If1ZR8Y\ → after the execution of the malicious lnk file

Rutina de descarga

Guarda los archivos que descarga con los nombres siguientes:

• {Download path}\Webwhats42738348419.39330.zip

Robo de información

Recopila los siguientes datos:

• GPU Information
• System Language

Otros detalles

Hace lo siguiente:

• The downloaded zip file contains the following files:
  • Webwhats427383396.156333.12855.pdf.lnk → fileless attack
  • Webwhats427383396.156333.12855.jpg → backup of the .lnk file
• If this Trojan runs in a Chrome browser, it will disable the following:
  • Security features in handling quarantined and / or suspicious files
  • Chrome Sandbox services
  • GPU Sandboxing
• It adds itself as an entry to the browser's suggested site configuration.