TrojanSpy.Win32.FAUXPERSKY.AA

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Löscht Dateien, so dass Programme und Anwendungen nicht ordnungsgemäß ausgeführt werden.

Verbindet sich mit einer bestimmten Website, um Daten zu versenden und zu empfangen.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Prozesse hinzu:

• %System%\cmd.exe /c ping -n 1 -w 1000 www.google.com.my>Ping.sb → checks internet connection
• {Malware file path}\winlogin.exe → if not running in the system
• %AppData%\Temp.exe → if file is downloaded successfully

Andere Systemänderungen

Löscht die folgenden Dateien:

• {Malware file path}\S_Core.txt
• {Malware file path}\S_CMD.txt
• {Malware file path}\S_PTC.txt

Prozessbeendigung

Beendet die folgenden Prozesse, wenn sie im Speicher des betroffenen Systems ausgeführt werden:

• msiexec.exe

Download-Routine

Öffnet die folgenden Websites, um Dateien herunterzuladen:

• https://kasperskypure.{BLOCKED}pp.com/S_Core.txt
• https://kasperskypure.{BLOCKED}pp.com/S_CMD.txt
• https://kasperskypure.{BLOCKED}pp.com/S_PTC.txt
• https://kasperskypure.{BLOCKED}pp.com/spoolsvc.exe → downloaded to update existing files in the system
• https://kasperskypure.{BLOCKED}pp.com/Temp.exe → downloaded to update existing files in the system

Speichert die heruntergeladenen Dateien unter den folgenden Namen:

• {Malware file path}\S_Core.txt
• {Malware file path}\S_CMD.txt
• {Malware file path}\S_PTC.txt
• {Malware file path}\spoolsvc.exe
• %AppData%\Temp.exe

Datendiebstahl

Folgende Daten werden gesammelt:

• OS Version
• Computer Name
• User Name
• IP Address
• Content:
  • Update number of downloaded files, spoolsvc.exe and Temp.exe
  • Success message if execution of downloaded files are successful

Andere Details

Verbindet sich mit der folgenden Website, um Daten zu versenden und zu empfangen:

• https://docs.google.com/forms/d/e/{BLOCKED}LSe6oGStKSshScVonAyCVFOrhANSfnmm0Im-aabnBX5ZjLabbA/viewform?entry.{BLOCKED}914=%A_OSVersion%&entry.{BLOCKED}477=%A_ComputerName%&entry.{BLOCKED}695=%A_UserName%&entry.{BLOCKED}0660=%A_IPAddress1%

Es macht Folgendes:

• It checks the contents of Ping.sb if it contains the string "could not find".
  • If found, it repeatedly checks for internet connection.
• It checks if all the components of the malware are already running.
• It checks if the following files are present in the directory where the sample is located:
  • winlogin.exe → executed if found
  • spoolsvc.exe
    • If found:
      • It compares the last update time of spoolsvc.exe with S_Core.txt.
      • If outdated, it downloads the updated version of the file.
• It checks if the following files are present in %AppData%:
  • Temp.exe
    • It downloads the file if not found.
    • It compares the last update time of Temp.exe with S_CMD.txt.
    • If outdated, it downloads the updated version of the file.
• It sets the file attributes of the following files to Read-Only, Hidden, and System:
  • {Malware file path}\spoolsvc.exe
  • %AppData%\Temp.exe
• It exfiltrates information via Google Forms.