TrojanSpy.MSIL.NEGASTEAL.KDL

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It steals certain information from the system and/or the user. It logs a user's keystrokes to steal information.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This Trojan Spy modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows Defender\Features
TamperProtection = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender
DisableAntiSpyware = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableBehaviorMonitoring = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableOnAccessProtection = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableScanOnRealtimeEnable = 1

Information Theft

This Trojan Spy steals the following information:

• IP Address
• Time
• Username
• Computer Name
• OS Name
• Processor Name
• Amouont of Memory
• Screenshot

It logs a user's keystrokes to steal information.

It attempts to steal stored account information used in the following installed File Transfer Protocol (FTP) clients or file manager software:

• FileZilla
• IPSwitch
• WinSCP
• FTP Navigator
• Flash FXP
• Smart FTP
• CFTP
• FTP Getter
• Internet Download Manager
• JDownloader
• Core FTP

It attempts to get stored information such as user names, passwords, and hostnames from the following browsers:

• Chrome
• Firefox
• Safari
• QQ Browser
• SeaMonkey
• Flock
• UC Browser
• BlackHawk
• CyberFox
• KMeleon
• IceCat
• IceDragon
• PaleMoon
• WaterFox

It attempts to steal stored email credentials from the following:

• Outlook
• Thunderbird
• Foxmail
• Opera Mail
• IncrediMail
• Pocomail
• Eudora
• The Bat!
• Postbox
• Claws Mail
• Becky!

Stolen Information

This Trojan Spy sends the data it gathers to the following email addresses via SMTP:

• {BLOCKED}do@montacargasperu.com

Other Details

This Trojan Spy does the following:

• Checks if the malware is being ran under sandbox mode by checking the username if it is one of the following:
  • USER
  • SANDBOX
  • VIRUS
  • MALWARE
  • SCHMIDTI
  • CURRENTUSER
• Also checks the %User Startup% path if it contains one of the following:
  • \VIRUS
  • SANDBOX
  • SAMPLE
• The email uses any of the following strings as it's subject:
  • C_{Username}/{Computer Name}
  • S_{Username}/{Computer Name}
  • K_{Username}/{Computer Name}
• The email body contains the stolen information and may have a jpeg or zip file attached

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows 2003(32-bit), XP and 2000(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit), 10(64-bit).)

It checks if the following virtual machine or sandbox related module(s) is loaded in the affected system:

• SbieDll.dll

It checks if the following virtual machine- or sandbox-related registry entries are present in the affected system:

HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\
Scsi\Scsi Port 0\Scsi Bus 0\
Target Id 0\Logical Unit Id 0
Identifier = {Registry entry that contains the string "VBOX"}

HKEY_LOCAL_MACHINE\HARDWARE\Description\
System
SystemBiosVersion = {Registry entry that contains the string "VBOX"}

HKEY_LOCAL_MACHINE\HARDWARE\Description\
System
VideoBiosVersion = {Registry entry that contains the string "VIRTUALBOX"}

HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\
VirtualBox Guest Additions
"" = noValueButYesKey

HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\
Scsi\Scsi Port 0\Scsi Bus 0\
Target Id 0\Logical Unit Id 0
Identifier = {Registry entry that contains the string "VMWARE"}

HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\
VMware Tools
"" = noValueButYesKey

HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\
Scsi\Scsi Port 1\Scsi Bus 0\
Target Id 0\Logical Unit Id 0
Identifier = {Registry entry that contains the string "VMWARE"}

HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\
Scsi\Scsi Port 2\Scsi Bus 0\
Target Id 0\Logical Unit Id 0
Identifier = {Registry entry that contains the string "VMWARE"}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Disk\Enum
0 = {Registry entry that contains the string "VMWARE"}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\
0000
DriverDesc = {Registry entry that contains the string "VMWARE"}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\
0000\Setting
Device Description = {Registry entry that contains the string "VMWARE"}

HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\
VMware Tools
InstallPath = {Registry entry that contains the string "C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\"}

HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\
Scsi\Scsi Port 0\Scsi Bus 0\
Target Id 0\Logical Unit Id 0
Identifier = {Registry entry that contains the string "QEMU"}

HKEY_LOCAL_MACHINE\HARDWARE\Description\
System
SystemBiosVersion = {Registry entry that contains the string "QEMU"}

It checks for the presence of the following antivirus and security applications:

• ESET NOD32