TrojanSpy.Win64.EMOTET.FBW

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Führt Befehle eines externen, böswilligen Benutzers aus, wodurch das betroffene System gefährdet wird.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Eigenkopien in das betroffene System ein und führt sie aus:

• If executed with administrator rights:
  • %System%\{Random Characters}\{Random Characters}.dll
• If executed without administrator rights:
  • %AppDataLocal%\{Random Characters}\{Random Characters}.dll

(Hinweis: %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) and 10(64-bit).)

Fügt die folgenden Prozesse hinzu:

• If executed with administrator rights:
  • %System%\regsvr32.exe "%System%\{Random Characters}\{Random Characters}.dll"
• If executed without administrator rights:
  • %System%\regsvr32.exe "%AppDataLocal%\{Random Characters}\{Random Characters}.dll"

(Hinweis: %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) and 10(64-bit).)

Erstellt die folgenden Ordner:

• If executed with administrator rights:
  • %System%\{Random Characters}
• If executed without administrator rights:
  • %AppDataLocal%\{Random Characters}

(Hinweis: %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) and 10(64-bit).)

Backdoor-Routine

Führt die folgenden Befehle eines externen, böswilligen Benutzers aus:

• Download and execute code in memory

Datendiebstahl

Folgende Daten werden gesammelt:

• Computer Name
• Volume Serial Number
• OS Information
• Process ID
• Machine Time zone

Andere Details

Es macht Folgendes:

• It receives commands and sends encrypted gathered information to the following URLs via HTTP/HTTPS POST by storing it on HTTP POST Headers.
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.165:8080/{Random Characters}
  • http://{BLOCKED}{BLOCKED}.{BLOCKED}1-{BLOCKED}-146.eu:8080/{Random Characters}
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.149:8080/{Random Characters}
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.28:8080/{Random Characters}
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.10:8080/{Random Characters}
  • https://{BLOCKED}.{BLOCKED}.{BLOCKED}.34:443/{Random Characters}
  • https://{BLOCKED}.{BLOCKED}.{BLOCKED}.25:443/{Random Characters}
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.30:8080/{Random Characters}
  • http://l{BLOCKED}-75.members.linode.com:8080/{Random Characters}
  • http://{BLOCKED}4.ip-94-23-45.eu:4143/{Random Characters}
  • https://{BLOCKED}.213-{BLOCKED}-212-5.clients.your-server.de:443/{Random Characters}
  • https://{BLOCKED}.{BLOCKED}.{BLOCKED}.124:443/{Random Characters}
  • http://{BLOCKED}31.members.linode.com:7080/{Random Characters}
  • http://{BLOCKED}.165.{BLOCKED}.4.185.clients.grserver.gr:8080/{Random Characters}
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.26:8080/{Random Characters}
  • https://{BLOCKED}.{BLOCKED}.{BLOCKED}.120.vultrusercontent.com:443/{Random Characters}
  • https://{BLOCKED}.{BLOCKED}.{BLOCKED}.2:443/{Random Characters}
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.76:8080/{Random Characters}
  • https://{BLOCKED}.{BLOCKED}.{BLOCKED}.93:443/{Random Characters}
  • https://{BLOCKED}.{BLOCKED}.{BLOCKED}.41:443/{Random Characters}
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.154:8080/{Random Characters}
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.27:8080/{Random Characters}
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.162:8080/{Random Characters}
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.137:8080/{Random Characters}
  • https://{BLOCKED}.{BLOCKED}.{BLOCKED}.217:443/{Random Characters}
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.15:8080/{Random Characters}
  • http://{BLOCKED}2.129.205.3-BY.ISPIO.COM:8080/{Random Characters}
  • https://{BLOCKED}146.kimsufi.com:443/{Random Characters}
  • http://{BLOCKED}meri.it:8080/{Random Characters}
  • http://o{BLOCKED}.dedicated.co.za:8080/{Random Characters}
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.217.95.clients.your-server.de:8080/{Random Characters}
  • http://{BLOCKED}.webs-up.com:8080/{Random Characters}
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.187.bitcom.com.br:443/{Random Characters}
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.199:8080/{Random Characters}
  • https://{BLOCKED}.{BLOCKED}.{BLOCKED}.56:443/{Random Characters}
  • https://cs.{BLOCKED}.net:443/{Random Characters}
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.232:8080/{Random Characters}
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.33:8080/{Random Characters}
  • http://a6.9c.{BLOCKED}.ip4.static.sl-reverse.com:8080/{Random Characters}
  • https://{BLOCKED}a2.virtua.com.br:443/{Random Characters}
  • http://{BLOCKED}-309-14521.vs.sakura.ne.jp:7080/{Random Characters}
  • http://{BLOCKED}-232-117-186.rackcorp.com:8080/{Random Characters}
  • http://serv.{BLOCKED}berita.com:8080/{Random Characters}
  • http://tk2-407-{BLOCKED}.vs.sakura.ne.jp:8080/{Random Characters}
  • http://v163-44-196-{BLOCKED}.a001.g.bkk1.static.cnode.io:8080/{Random Characters}
  • http://vmi277069.{BLOCKED}oserver.net:8080/{Random Characters}
  • http://{BLOCKED}66f4a3.vps.ovh.net:8080/{Random Characters}