HKTL_SKINMINER.GA

November 25, 2015
 Analysis by: Janus Agcaoili
 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Hacking Tool

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

This hacking tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be manually installed by a user.

  TECHNICAL DETAILS

File Size:

707,584 bytes

File Type:

EXE

Memory Resident:

No

Initial Samples Received Date:

14 May 2014

Arrival Details

This hacking tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be manually installed by a user.

Other Details

This hacking tool does the following:

  • Displays this the following when executed:
  • Downloads a minecraft skin from http://skins.minecraft.net/MinecraftSkins/{file name}.png using the "Username" supplied by the user as file name when the "Preview" button is clicked
    • Saves the downloaded skin as %User Temp%\mcskin.png
    • Example:
  • Saves the downloaded skin to the users preferred location and file name when "Save Skin" button is clicked
  • Tries to upload the downloaded skin to the users minecraft account on https://minecraft.net/ using internet explorer when "Upload Skin" is clicked
  • Displays the "Credits" window when the submenu "About" under the "Help" menu is clicked
  • Displays the "Changelogs" window when the submenu "Change Log" under the "Help" menu is clicked
  • Download a copy of its updated version when the submenu "Check for Updates" under the "Help" menu is clicked and choosing "Yes" on the dialog box
    • The updated copy is downloaded from https://dl.dropboxusercontent/s/apluu4mafvdxufv/Minecraft%20Skin%20Stealer.exe
    • The updated copy is saved as {Current Directory}\Minecraft Skin Stealer {Version}.exe
  • Displays the "Help" window when the submenu "How to upload directly to Minecraft.net?" under the "Help" menu is clicked

  SOLUTION

Minimum Scan Engine:

9.800

FIRST VSAPI PATTERN FILE:

1.680.47

FIRST VSAPI PATTERN DATE:

24 Nov 2015

VSAPI OPR PATTERN File:

1.681.00

VSAPI OPR PATTERN Date:

25 Nov 2015

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Scan your computer with your Trend Micro product to delete files detected as HKTL_SKINMINER.GA. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.