TrojanSpy.MSIL.REDLINESTEALER.XDAXZ

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Verbindet sich mit einer bestimmten Website, um Daten zu versenden und zu empfangen.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Datendiebstahl

Folgende Daten werden gesammelt:

• Gathers the following system information:
  • Username
  • Domain Name
  • Serial Number
  • Keyboard Layout
  • Screen Resolution
  • Operating System
  • GPU Information
  • CPU Information
  • IP Address
  • System Language
  • System Timezone
  • RAM
  • Installed Browsers
  • Installed Programs
  • Installed Security Software
  • Running processes
• Gathers information from:
  • Browsers:
  • Chrome Based Browsers
  • Gecko Based Browsers
  • Opera GX Stable
  • Opera GX
  • FTP Clients:
  • FileZilla
  • Messaging Applications:
  • Telegram
  • VPN:
  • NordVPN
  • OpenVPN
  • ProtonVPN
  • Wallets:
  • Data from wallet.dat files
  • Others:
  • Steam
  • Discord
• Browser Extensions:
  • Autofill data
  • Login data
  • Web data
  • Cookies
• Gathers the specific files depending on the configurations received from the server.

Andere Details

Verbindet sich mit der folgenden Website, um Daten zu versenden und zu empfangen:

• net.tcp://{BLOCKED}.{BLOCKED}.41.175:44271/

Es macht Folgendes:

• It deletes the following folder if creation date is greater than 3 months:
  • %AppDataLocal%\Microsoft\Windows
• It creates the following folder if not existing or was deleted based on the condition above:
  • %AppDataLocal%\Microsoft\Windows