TrojanSpy.Win64.GARYSTEAL.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Ejecuta comandos desde un usuario remoto malicioso que pone en peligro el sistema afectado.

Se conecta a determinados sitios Web para enviar y recibir información.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Muestra los siguientes mensajes falsos de error:

Rutina de puerta trasera

Ejecuta los comandos siguientes desde un usuario remoto malicioso:

• Create startup persistence
• Perform stealer capabilities
• Execute arbitrary commands
• Display alert messages
• Retrieve running processes
• Execute files on disk or in memory
• Access and write to the clipboard
• Perform a random task
• Download and execute additional payloads
• Terminate itself
• Delete itself

Robo de información

Recopila los siguientes datos:

• Host information
• Access privilege level
• OS information
• Network information
• Browser data
• Cryptocurrency wallet data

Otros detalles

Se conecta al sitio Web siguiente para enviar y recibir información:

• {BLOCKED}.ngrok.io:18560

Hace lo siguiente:

• It sends an HTTP GET request to the following URL as a build validator:
  • http://{BLOCKED}grok.io:18560/api/v1/bulla/?id=cln0hnnun0000rxwn99y3ueza&data={Encrypted Unix Time}
• It checks if the following virtual machine- or sandbox-related MAC addresses are present in the affected system:
  • 00:1C:42
  • 08:00:27
  • 00:05:69
  • 00:0C:29
  • 00:1C:14
  • 00:50:56
  • 00:16:E3
• It performs random tasks once it detects virtual machine- or sandbox-related indicators are present in the affected machine:
  • Send a ping to google.com:80
  • Create a config file: %User Profile%\config.ini
  • List files found on the %User Profile% directory
  • List local IP addresses
  • Send an HTTP GET request to https://www.web3api.com
  • Print a random number
  • Create a randomly named folder: %User Profile%\{Random Characters}.txt
  • Print a random string