TrojanSpy.JS.NEMUCOD.BONING

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. However, as of this writing, the said sites are inaccessible.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

It deletes itself after execution.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

However, as of this writing, the said sites are inaccessible.

Backdoor Routine

This Trojan Spy executes the following commands from a remote malicious user:

• Update Itself/Replace Initial Script
• Execute File

It connects to the following websites to send and receive information:

• https: //185.{BLOCKED}.82.15/ho{BLOCKED}le/c644.php

Information Theft

This Trojan Spy gathers the following data:

• Process List
• User Name
• Domain Name
• OS Version

Other Details

This Trojan Spy does the following:

• If it fails to download a file from its C&C Server, it locates for files with the following extensions in shared and removable drives, deletes the file and replaces the deleted file with a copy of itself:
  • .doc
  • .xls
  • .pdf
  • .rtf
  • .txt
  • .pub
  • .odt
  • .ods
  • .odp
  • .odm
  • .odc
  • .odb
• It terminates itself if it satisfies any of the following conditions.
  • Any of the following processes are found in the affected system’s memory:
    • anti - virus.EXE
    • lordPE.exe
    • B.exe
    • iexplore.exe
    • Proxifier.exe
    • ctfmon.exe
    • AgentSimulator.exe
    • VzService.exe
    • VBoxTray.exe
    • gemu - ga.exe
    • BennyDB.exe
    • windanr.exe
  • Any of the following debugging tools are found in the system:
    • Procmon
    • Wireshark
    • ProcessHacker
    • vmtoolsd
    • VBoxService
    • ImmunityDebugger
    • BehaviorDumper
    • PROCMON
    • procexp
    • tcpdump
    • FrzState2k
    • DFLocker64
    • vmware
    • LOGSystem.Agent.Service.exe
  • Any of the following strings are existing in the environment that it is executed:
    • VmRemoteGuest
    • SystemIT | admin
    • WIN7 - TRAPS
    • Emily
    • milozs
    • Johnson
    • HAPUBWS
    • Peter Wilson
    • Hong Lee

  It deletes itself after execution.