TrojanSpy.Win64.STEALDEAL.C

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• %User Temp%\{Compromised browser}\Administrator#History.csv
• %User Temp%\{Compromised browser}\Administrator#LoginData.csv
• %User Temp%\Microsoft Edge\SS_ErrorLog.txt
• %User Temp%\Mozilla Firefox\SS_ErrorLog.txt
• %User Temp%\Yandex Browser\SS_ErrorLog.txt
• %User Temp%\Chromium\SS_ErrorLog.txt
• %User Temp%\Chrome Beta\SS_ErrorLog.txt
• %User Temp%\Google Chrome\S_ErrorLog.txt
• %AppDataLocal%\{Compromised browser}\User Data\Default\History_copy_
• %AppDataLocal%\{Compromised browser}\User Data\Default\Login Data_copy_
• %AppDataLocal%\{Compromised browser}\User Data\Default\Web Data_copy_

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).

Robo de información

Recopila los siguientes datos:

• Stored credentials, history, and etc. from the following browsers:
  • Google Chrome
  • Microsoft Edge
  • Mozilla Firefox
  • Chromium
  • Chrome Beta
  • Yandex Browser
• Information related to installed mailed clients
  • HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\User\{User ID}