Backdoor.MSIL.ASYNCRAT.THABFBB

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Führt Befehle eines externen, böswilligen Benutzers aus, wodurch das betroffene System gefährdet wird.

Sammelt bestimmte Informationen auf dem betroffenen Computer.

Beendet sich selbst, falls festgestellt wird, dass die Ausführung in einer virtuellen Umgebung erfolgt.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Mutexe hinzu, damit nur jeweils eine ihrer Kopien ausgeführt wird:

• SvchosMutex_qwqdanchun

Backdoor-Routine

Führt die folgenden Befehle eines externen, böswilligen Benutzers aus:

• Ping test
• Execute sent plugin

Datendiebstahl

Sammelt die folgenden Informationen auf dem betroffenen Computer:

• Packet = ClientInfo
• HWID = HWID generated from processor count, username, computer name, OS version, and total size of the system directory
• User = System Username
• OS = OS information
• Camera = Camera devices available
• Path = Malware installed path
• Version = {encrypted value}
• Admin = Has admin role
• Perfor_mance = {Window Title}
• Paste_bin = {encrypted value}
• Anti_virus = Installed AV products
• Install_ed = Time installed
• Po_ng = {null}
• Group = {encrypted value}

Andere Details

Beendet sich selbst, falls festgestellt wird, dass die Ausführung in einer virtuellen Umgebung erfolgt.

Es macht Folgendes:

• Upon execution it decrypts strings for its configuration:
• Key → {encrypted value}
• New Key → false
• Port → 8849
• Host → {Host to connect}
• Version → 1.0.7
• Install → false
• MTX → SvchosMutex_qwqdanchun
• Paste_bin → null
• An_ti → true
• Anti_Process → false
• BS_OD → true
• Group → Default
• HWID → {encrypted value}
• Server_signa_ture → {encrypted value}
• Certifi_cate → {encrypted value}
• VerifyHash → true
• It checks whether the System is a Windows Client or a Windows Server.
• It checks whether the System is running on x86 or x64 Windows platform.
• It retrieves information about the cache memory.
• Depending on its configuration, it is capable on executing the following functions:
• Terminating the following processes:
• Taskmgr.exe
• ProcessHacker.exe
• procexp.exe
• MSASCui.exe
• MsMpEng.exe
• MpUXSrv.exe
• MpCmdRun.exe
• NisSrv.exe
• ConfigSecurityPolicy.exe
• MSConfig.exe
• Regedit.exe
• UserAccountControlSettings.exe
• taskkill.exe
• Establish persistence with the following conditions:
• If has an admin privilege, it will create a scheduled task to execute the malware on every user log on.
• If has normal user privilege, it adds itself on start up processes by modifying system registry.
• It creates a .bat file to execute itself as a process then deletes itself after execution.