TrojanSpy.Win32.STEALC.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Löscht Dateien, so dass Programme und Anwendungen nicht ordnungsgemäß ausgeführt werden.

Diese Malware hat keine Verbreitungsroutine.

Diese Malware hat keine Backdoor-Routine.

Sammelt bestimmte Informationen auf dem betroffenen Computer.

Verbindet sich mit einer bestimmten Website, um Daten zu versenden und zu empfangen.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust folgende Komponentendateien ein:

• %ProgramData%\sqlite3.dll
• %ProgramData%\freebl3.dll
• %ProgramData%\mozglue.dll
• %ProgramData%\msvcp40.dll
• %ProgramData%\nss3.dll
• %ProgramData%\softokn3.dll
• %ProgramData%\vcruntime140.dll

Fügt die folgenden Prozesse hinzu:

• "%System%\cmd.exe" /c timeout /t 5 & del /f /q "{Malware File Path}\{Malware File Name}" & del "%ProgramData%\*.dll" & exit

Andere Systemänderungen

Löscht die folgenden Dateien:

• {Malware File Path}\{Malware File Name}.{Malware File Extension}
• %ProgramData%\{File Name}.dll

Verbreitung

Diese Malware hat keine Verbreitungsroutine.

Backdoor-Routine

Diese Malware hat keine Backdoor-Routine.

Datendiebstahl

Sammelt die folgenden Informationen auf dem betroffenen Computer:

• System Information:
  • Public IP address
  • Geolocation
  • Hardware ID
  • Operating system version
  • System architecture
  • Username
  • Computer name
  • Local time
  • Time zone information
  • Language
  • Keyboard layout
  • If machine is laptop or desktop
  • {Malware File Path}\{Malware File Name}
  • Physical resources
    • CPU core count
    • CPU name
    • RAM amount
    • Number of threads
    • Display resolution
    • GPU driver
  • List of running processes
  • List of installed applications
• Screenshot of current display
• Browser data (e.g. autofills, cookies, credentials, credit card data, browser extensions)
  • Chromium-based browsers
  • Firefox-based browsers
  • Opera-based browsers
• Email credentials:
  • Outlook
• Cryptocurrency wallet data
• Telegram session data
• Steam metadata
• Discord tokens
• Account credentials:
  • Tox
  • Pidgin

Andere Details

Verbindet sich mit der folgenden Website, um Daten zu versenden und zu empfangen:

• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.7/b5c26998bb7c2272.php

Es macht Folgendes:

• It terminates itself when one of the following conditions is met:
  • If system processor count is less than 2
  • If system display raster lines is less than 666
  • If system default computer language is one of the following:
    • Russian
    • Ukranian
    • Belarussian
    • Kazakh
    • Uzbek (Latin)
  • If system computer name is HAL9TH and username is JohnDoe
  • If system total physical memory is less than 1,111 megabytes
  • If the malware is executed after August 27, 2023
• It accesses the following websites to download its configuration/component files:
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.7/b5c26998bb7c2272.php
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.7:80/714211d16652b54f/sqlite3.dll
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.7:80/714211d16652b54f/freebl3.dll
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.7:80/714211d16652b54f/mozglue.dll
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.7:80/714211d16652b54f/msvcp40.dll
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.7:80/714211d16652b54f/nss3.dll -
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.7:80/714211d16652b54f/softokn3.dll
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.7:80/714211d16652b54f/vcruntime140.dll