TSPY_NOON.JKS
Win32.Trojan-spy.Noon.Hufq (Tencent), Troj.Spy.W32.Noon!c (AegisLab)
Windows
Threat Type: Trojan Spy
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
TECHNICAL DETAILS
284,195 bytes
Other
Yes
01 Mar 2018
Arrival Details
This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This Trojan Spy drops the following files:
- %Application Data%\468-5O42\468log.ini
- %Application Data%\468-5O42\468logim.jpeg
- %Application Data%\468-5O42\468logrf.ini
- %Application Data%\468-5O42\468logri.ini
- %Application Data%\468-5O42\468logrv.ini
(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)
It drops the following copies of itself into the affected system:
- %Program Files%\{random folder name}\{random filename}.exe
(Note: %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.)
It creates the following folders:
- %Program Files%\{random folder name}
- %Application Data%\468-5O42
(Note: %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)
Other Details
This Trojan Spy connects to the following possibly malicious URL:
- http://www.{BLOCKED}ngpros.com/po
- http://www.{BLOCKED}schmidt.com/po
- http://www.{BLOCKED}imes.com/po
- http://www.{BLOCKED}s.com/po
- http://www.{BLOCKED}valenorth.net/po
- http://www.{BLOCKED}ay.com/po
- http://www.{BLOCKED}tybinges.com/po
- http://www.{BLOCKED}tenews.com/po
- http://www.{BLOCKED}althinsurancepro.com/po
- http://www.{BLOCKED}rutour-pangandaran.com/po
- http://www.{BLOCKED}sterbooster.com/po
- http://www.{BLOCKED}esbeauty.info/po
- http://www.{BLOCKED}88.com/po