TrojanSpy.MSIL.WORLDWIND.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Ordner hinzu:

• %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}
• %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Grabber
• %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Grabber\DRIVE-{Drive Letter} → replica of drives in the machine
• %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Browsers
• %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Browsers\{Browser Name}
• %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Messenger\Discord
• %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Messenger\Pidgin
• %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Messenger\Telegram
• %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Gaming\Steam
• %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Gaming\Uplay
• %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Gaming\Minecraft
• %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Wallets
• %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Wallets\{Wallet Name}
• %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\FileZilla
• %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\VPN\ProtonVPN
• %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\VPN\OpenVPN
• %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\VPN\NordVPN
• %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Directories
• %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\System

Schleust die folgenden Dateien ein:

• %AppDataLocal%\{Hash Value}\history.dat → contains keylogged data; modifies the file attributes to make the file hidden
• %AppDataLocal%\{Hash Value}\msgid.dat → contains latest message ID

Fügt die folgenden Prozesse hinzu:

• cmd.exe /C chcp 65001 && netsh wlan show profile | findstr All → to retrieve the wireless network profiles
• cmd.exe /C chcp 65001 && netsh wlan show profile name=\""{Profile}"\"key=clear | findstr Key" → to retrieve the clear-text Wi-Fi password for a specific wireless network profile
• cmd.exe /C chcp 65001 && netsh wlan show networks mode=bssid → to retrieve the available wireless networks and their BSSIDs
• cmd.exe /c schtasks /create /f /sc onlogon /rl highest /tn \{Malware File Name without Extension}\ /tr \{Malware File Path}\{Malware File Name}\ & exit

Fügt die folgenden Mutexe hinzu, damit nur jeweils eine ihrer Kopien ausgeführt wird:

• vx/BE7jbRUB6mf7JvBe7Aqms5ens79dF75erQeF42sT5vvO+4N9X2zk0aqxqkuguWA/A06An2byEZbqi5N4oc6eDd74t2bt19gesw0UIL8c=

Autostart-Technik

Fügt folgende Registrierungseinträge hinzu, um bei jedem Systemstart automatisch ausgeführt zu werden.

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{Malware File Name} = {Malware File Path}\{Malware File Name}.exe

Datendiebstahl

Folgende Daten werden gesammelt:

• Browser:
  • Credit Card Data
  • Login Data
  • Cookies
  • Browsing History
  • Download History
  • Autofill Data
  • Bookmarks
• FileZilla:
  • Host
  • Port
  • Username
  • Password
• VPN:
  • User Configuration
• Discord:
  • Token
• Pidgin:
  • Protocol
  • Login Data
  • Password
• Telegram:
  • Folders with folder name 16 characters long
  • Files with size less than or equal to 5120 bytes
  • Files with file name ending in s and 17 characters long
  • Files with file name starting with "usertag", "settings", or "key_data"
• Steam:
  • Application Name
  • GameID
  • Installed(Yes or No)
  • Running (Yes or No)
  • Updating (Yes or No)
  • Steam Authorization File
  • Autologin Data
• Uplay:
  • Files in the folder %AppDataLocal%\Ubisoft Game Launcher
• Minecraft:
  • Profiles
  • Servers
  • Screenshots
  • Modifications
  • Versions
• Directories Structure
• Running Processes:
  • Process Name
  • Process ID
  • Process Path
• Open Windows:
  • Process Name
  • Window Title
  • Process ID
  • Process Path
• Screenshot
• Webcam Capture
• Saved Wireless Networks:
  • Profile
  • Passwords
• Available Wireless Networks
• Product ID
• System Information:
  • Current Date and Time
  • System Version
  • User Name
  • Computer Name
  • Language
  • Installed Anti Virus Products
  • CPU Processor
  • GPU Name
  • RAM Amount
  • Processor ID
  • Battery Information
  • Screen Size
  • Default Gateway
  • Internal IP
  • External IP
  • Location
  • Log Files
  • Keystrokes
• Gathers information from:
  • Browsers:
    • Microsoft Edge
    • Gecko Based Browsers:
      • Firefox
      • Waterfox
      • K-Meleon
      • Thunderbird
      • IceDragon
      • Cyberfox
      • BlackHawk
      • Pale Moon
    • Chromium Based:
      • Chromium
      • Google Chrome
      • Opera Software
      • ChromePlus
      • Iridium
      • 7Star
      • CentBrowser
      • Chedot
      • Vivaldi
      • Kometa
      • Elements Browser
      • Epic Privacy Browser
      • Uran
      • Sleipnir5
      • Citrio
      • Coowon
      • liebao
      • QIP Surf
      • Orbitum
      • Comodo Dragon
      • Amigo
      • Torch
      • Yandex Browser
      • 360Browser
      • Maxthon3
      • K-Melon
      • Sputnik
      • Nichrome
      • CocCoc Browser
      • Chromodo
      • Atom
      • Brave-Browser
• FTP Clients:
  • FileZilla
• VPN:
  • ProtonVPN
  • NordVPN
  • OpenVPN
• Messaging Applications:
  • Discord
  • Pidgin
  • Telegram
• Gaming:
  • Steam
  • Uplay
  • Minecraft
• Cryptocurrency Wallets:
  • Zcash
  • Armory
  • bytecoin
  • Jaxx
  • Exodus
  • Ethereum
  • Electrum
  • AtomicWallet
  • Guards
  • Coinomi
  • Litecoin
  • Dash
  • Bitcoin

Entwendete Daten

Speichert die entwendeten Informationen in der folgenden Datei:

• Edge and Chromium Based Browsers:
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Browsers\{Browser Name}\CreditCards.txt
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Browsers\{Browser Name}\Passwords.txt
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Browsers\{Browser Name}\Cookies.txt
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Browsers\{Browser Name}\History.txt
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Browsers\{Browser Name}\Downloads.txt
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Browsers\{Browser Name}\AutoFill.txt
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Browsers\{Browser Name}\Bookmarks.txt
• Gecko Based Browsers:
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Browsers\{Browser Name}\Bookmarks.txt
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Browsers\{Browser Name}\Cookies.txt
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Browsers\{Browser Name}\History.txt
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Browsers\{Browser Name}\login.json → copy of the login.json file
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Browsers\{Browser Name}\key3.db → copy of the key3.db file
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Browsers\{Browser Name}\key4.db → copy of the key4.db file
• Discord:
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Messenger\Discord\tokens.txt
• Pidgin:
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Messenger\Pidgin\accounts.txt
• Telegram:
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Messenger\Telegram\{Folders in %Application Data%\Telegram\tdata with folder name 16 characters long}
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Messenger\Telegram\{Files in %Application Data%\Telegram\tdata with size less than or equal to 5120 bytes}
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Messenger\Telegram\{Files in %Application Data%\Telegram\tdata with file name ending in s and 17 characters long}
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Messenger\Telegram\{Files in %Application Data%\Telegram\tdata with file name starting with "usertag", "settings", or "key_data"}
• Steam:
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Gaming\Steam\Apps.txt
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Gaming\Steam\{Files in the Steam install path with "ssfn" in its file name}
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Gaming\Steam\SteamInfo.txt
• Uplay:
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Gaming\Uplay\{Files in %AppDataLocal%\Ubisoft Game Launcher}
• Minecraft:
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Gaming\Minecraft\launcher_profiles.json
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Gaming\Minecraft\servers.dat
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Gaming\Minecraft\screenshots\{Screenshot Images}
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Gaming\Minecraft\mods.txt
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Gaming\Minecraft\versions.txt
• Cryptocurrency Wallets:
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Wallets\Zcash
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Wallets\Armory
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Wallets\bytecoin
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Wallets\Jaxx\com.liberty.jax\IndexedDB\file__0.indexeddb.leveldb
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Wallets\Exodus\exodus.wallet
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Wallets\Ethereum\keystore
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Wallets\Electrum\wallets
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Wallets\atomic\Local Storage\leveldb
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Wallets\Guarda\Local Storage\leveldb
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Wallets\Coinomi\Coinomi\wallets
• FileZilla:
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\FileZilla\Hosts.txt
• ProtonVPN:
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\ProtonVPN\{Subdirectories of %AppDataLocal%\ProtonVPN containing the string "Proton.exe" in its name}\user.config
• OpenVPN:
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\OpenVPN\profiles\{Files in %Application Data%\OpenVPN Connect\profiles with the extension .ovpn}
• NordVPN:
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\NordVPN\{Subdirectories of %AppDataLocal%\NordVPN containing the string "NordVpn.exe" in its name}\accounts.txt
• Directory Tree:
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\Directories\{Directory Name}.txt
• System Information:
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\System\Process.txt
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\System\Windows.txt
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\System\WorldWind.jpg
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\System\Webcam.jpg
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\System\SavedNetworks.txt
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\System\ScanningNetworks.txt
  • %AppDataLocal%\{Hash Value}\{User Name}@{Computer Name}_{Default User Locale}\System\ProductKey.txt

(Hinweis: %Application Data% ist der Ordner 'Anwendungsdaten' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Anwendungsdaten unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Anwendungsdaten unter Windows NT, C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Anwendungsdaten unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)

Andere Details

Es macht Folgendes:

• terminates itself if the any of the following conditions are satisfied:
  • If the manufacturer is "microsoft corporation" and the model contains the following strings:
    • VIRTUAL
    • vmware
    • VirtualBox
  • If the following sandbox related modules is loaded in the affected system:
    • SbieDll.dll
  • If the total size of the drive containing the system directory is <= 61 GB.
  • If the OS contains the string "xp".
• It creates a copy of the file it steals.
• It sends the stolen information via Telegram bot.
• It deletes the file after uploading.
• If the file to be sent is a directory, it creates a zip file and then deletes the original directory.