Trojan.MSIL.FRS.VSNW0BK24

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Agrega las carpetas siguientes:

• If -o | --output parameter is used:
  • {Path Set by the User}\EyeWitness_{Date}_{Time}
  • {Path Set by the User}\EyeWitness_{Date}_{Time}\headers
  • {Path Set by the User}\EyeWitness_{Date}_{Time}\images
  • {Path Set by the User}\EyeWitness_{Date}_{Time}\src
  
  Otherwise:
  • %Application Data%\EyeWitness_{Date}_{Time}
  • %Application Data%\EyeWitness_{Date}_{Time}\headers
  • %Application Data%\EyeWitness_{Date}_{Time}\images
  • %Application Data%\EyeWitness_{Date}_{Time}\src

(Nota: %Application Data% es la carpeta Application Data del usuario activo, que en el caso de Windows 98 y ME suele estar ubicada en C:\Windows\Profiles\{nombre de usuario}\Application Data, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Application Data, en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) en C:\Documents and Settings\{nombre de usuario}\Local Settings\Application Data y en el caso de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Roaming.).

Infiltra los archivos siguientes:

• If -o | --output parameter is used:
  • {Path Set by the User}\EyeWitness_{Date}_{Time}\headers\{URL Accessed}.txt → contains the HTTP response headers from the captured webpage
  • {Path Set by the User}\EyeWitness_{Date}_{Time}\images\{URL Accessed}.bmp → contains screenshot of the webpage as rendered by EyeWitness
  • {Path Set by the User}\EyeWitness_{Date}_{Time}\src\{URL Accessed}.txt → contains the full HTML, JavaScript, and CSS source code of the webpage
  • {Path Set by the User}\EyeWitness_{Date}_{Time}\report_page1.html → contains the generated report, showing details of the web request, HTTP headers, source code, and a screenshot of the captured webpage
  
  Otherwise:
  • %Application Data%\EyeWitness_{Date}_{Time}\headers\{URL Accessed}.txt
  • %Application Data%\EyeWitness_{Date}_{Time}\images\{URL Accessed}.bmp
  • %Application Data%\EyeWitness_{Date}_{Time}\src\{URL Accessed}.txt
  • %Application Data%\EyeWitness_{Date}_{Time}\report_page1.html
    
    
• It compresses the above files into the following if -c | --compress parameter is used:
  • {Path Set by the User}\EyeWitness_{Date}_{Time}.zip or
  • %Application Data%\EyeWitness_{Date}_{Time}.zip

(Nota: %Application Data% es la carpeta Application Data del usuario activo, que en el caso de Windows 98 y ME suele estar ubicada en C:\Windows\Profiles\{nombre de usuario}\Application Data, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Application Data, en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) en C:\Documents and Settings\{nombre de usuario}\Local Settings\Application Data y en el caso de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Roaming.).

Otros detalles

Hace lo siguiente:

• It captures screenshots of web pages, analyzing HTTP responses, and generating reports for reconnaissance and security assessments.
• It uses the following version of EyeWitness:
  • EyeWitness v1.1