arrow_back
search
close

TSPY_NOON.JKS

March 06, 2018
 Analysis by: John Kevin Sanchez
 ALIASES:

Win32.Trojan-spy.Noon.Hufq (Tencent), Troj.Spy.W32.Noon!c (AegisLab)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan Spy

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW


This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

File Size:

284,195 bytes

File Type:

Other

Memory Resident:

Yes

Initial Samples Received Date:

01 Mar 2018

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy drops the following files:

  • %Application Data%\468-5O42\468log.ini
  • %Application Data%\468-5O42\468logim.jpeg
  • %Application Data%\468-5O42\468logrf.ini
  • %Application Data%\468-5O42\468logri.ini
  • %Application Data%\468-5O42\468logrv.ini

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following copies of itself into the affected system:

  • %Program Files%\{random folder name}\{random filename}.exe

(Note: %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.)

It creates the following folders:

  • %Program Files%\{random folder name}
  • %Application Data%\468-5O42

(Note: %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other Details

This Trojan Spy connects to the following possibly malicious URL:

  • http://www.{BLOCKED}ngpros.com/po
  • http://www.{BLOCKED}schmidt.com/po
  • http://www.{BLOCKED}imes.com/po
  • http://www.{BLOCKED}s.com/po
  • http://www.{BLOCKED}valenorth.net/po
  • http://www.{BLOCKED}ay.com/po
  • http://www.{BLOCKED}tybinges.com/po
  • http://www.{BLOCKED}tenews.com/po
  • http://www.{BLOCKED}althinsurancepro.com/po
  • http://www.{BLOCKED}rutour-pangandaran.com/po
  • http://www.{BLOCKED}sterbooster.com/po
  • http://www.{BLOCKED}esbeauty.info/po
  • http://www.{BLOCKED}88.com/po