HackTool.MSIL.Sharpdump.YPCKQT
HackTool:MSIL/SharpDump (MICROSOFT)
Windows
Threat Type: Hacking Tool
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
Downloaded from the Internet, Dropped by other malware
This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It executes commands from a remote malicious user, effectively compromising the affected system.
TECHNICAL DETAILS
120,832 bytes
DLL
No
17 Nov 2022
Executes files
Arrival Details
This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Backdoor Routine
This Hacking Tool executes the following commands from a remote malicious user:
- clr_dumplsass → Dump LSASS memory. It can contain a directory where the dumped LSASS is being stored, or, by default, it will be saved in %systemroot%\Temp
- clr_pwd → Get current Directory
- clr_ls → List current directory or the argument
- clr_cd → Set the current directory with a custom PATH parameter.
- clr_ping → Ping command
- clr_rm → Delete specified file
- clr_cat → Get content of specified file
- clr_ps → List running processes
- clr_netstat → netstat command to get active connections
- clr_getav → List installed AV products
- clr_rdp → Enable RDP on device and return the RDP port number
- clr_adduser → Creates a user under Administrators group with custom username and password
- clr_cmd → Execute custom commands
- clr_exec → Executes a file with specified argument.
- It accepts the following parameter:
- "-p" - process name
- "-a" - argument of process
- If it does not contain '-p', it works the same way as clr_cmd.
- It accepts the following parameter:
- clr_efspotato → Local Privilege Escalation using EfsPotato
- it accepts the following parameters:
- "-p" - target process
- "-a" - argument
- it accepts the following parameters:
Other Details
This Hacking Tool does the following:
- It is capable to use PingCastle - a tool that can be used to collect information required for attacks in Active Directory environments
SOLUTION
9.800
2.677.00
23 Nov 2023
Step 1
Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.
Step 2
Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.
Step 3
Scan your computer with your Trend Micro product to delete files detected as HackTool.MSIL.Sharpdump.YPCKQT. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:
Did this description help? Tell us how we did.