TrojanSpy.PS1.NEGASTEAL.FBV

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes then deletes itself afterward.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy drops the following files:

• %ProgramData%\TUKHAMTASSER\Sexology.~!!!!!!!!!!!!!!!!~ ← deleted afterwards
• %ProgramData%\TUKHAMTASSER\NIKKIL_LORY.vbs ← later moved to %User Startup%\NIKKIL_LORY.vbs
• %System Root%\drivers\etc\hosts

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.. %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows 2003(32-bit), XP and 2000(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit), 10(64-bit).. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It adds the following processes:

• "%System%\net.exe" user {Malware Created User} /add
• "%System%\net.exe" user {Malware Created User} {Password}
• "%System%\net.exe" localgroup administrators {Malware Created User} /add
• "%System%\net.exe" localgroup "Remote Desktop Users" {Malware Created User} /add
• "%System%\net.exe" stop WdNisSvc
• "%System%\netsh.exe" advfirewall set allprofiles state off
• "%System%\schtasks.exe" /create /sc MINUTE /mo 187 /tn clomepe /F /tr "wscript /nologo %ProgramData%\TUKHAMTASSER\NIKKIL_LORY.vbs"

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)

It creates the following folders:

• %ProgramData%\TUKHAMTASSER

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)

It executes then deletes itself afterward.

Other System Modifications

This Trojan Spy adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Classes\
CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32
(Default) = C:\IDontExist.dll

It adds the following registry keys as part of its installation routine:

HKEY_CURRENT_USER\Software\Classes\
CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}

HKEY_CURRENT_USER\Software\Classes\
CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32

Process Termination

This Trojan Spy terminates the following services if found on the affected system:

• WdNisSvc
• WinDefend

Information Theft

This Trojan Spy gathers the following data:

• Computer Name
• User Name
• CPU Information
• RAM Information
• Network Adapter Configuration
• IP Address
• Current time
• It gathers credentials from the following:
  • Browsers (User Data):
    • 360 Browser
    • 7Star
    • Amigo
    • BlackHawk
    • Brave
    • CentBrowser
    • Chedot
    • Chrome
    • Chromium
    • Citrio
    • Coccoc
    • Comodo Dragon
    • Cool Novo
    • Coowon
    • CyberFox
    • Edge Chromium
    • Elements Browser
    • Epic Privacy
    • Falkon Browser
    • Firefox
    • Flock
    • Flock Browser
    • IceCat
    • IceDragon
    • IE/Edge
    • Iridium Browser
    • K-Meleon
    • Kometa
    • Liebao Browser
    • Opera Browser
    • Orbitum
    • PaleMoon
    • QIP Surf
    • QQ Browser
    • Safari for Windows
    • SeaMonkey
    • Sleipnir 6
    • Sputnik
    • Torch Browser
    • UC Browser
    • Uran
    • Vivaldi
    • WaterFox
    • Yandex
  • Email Clients:
    • Becky!
    • Claws Mail
    • eM client
    • Eudora
    • Foxmail
    • IncrediMail
    • Mailbird
    • Opera Mail
    • Outlook
    • Pocomail
    • Postbox
    • The Bat!
    • Thunderbird
    • Windows Mail App
  • FTPs:
    • cftp
    • CoreFTP
    • FileZilla
    • FlashFXP
    • FTP Commander
    • FTP Getter
    • FTP Navigator
    • SmartFTP
    • WinSCP
    • WS_FTP
  • VPNs:
    • NordVPN
    • OpenVPN
    • Private Internet Access
  • Instant Messaging Applications:
    • Discord
    • Psi/Psi+
    • Trillian
  • Other Applications:
    • Internet Download Manager
    • Jdownloader 2.0
    • MySQL Workbench
    • Apple Keychain
  • VNCs:
    • RealVNC 4.x
    • RealVNC 3.x
    • TightVNC
    • TigerVNC
    • UltraVNC
  • Vault:
    • Web Credentials
    • Windows Credential Picker Protector
    • Windows Credentials
    • Windows Domain Certificate Credential
    • Windows Domain Password Credential
    • Windows Extended Credential
    • Windows Secure Note
    • Windows Web Password Credential

Stolen Information

This Trojan Spy sends the gathered information via HTTP POST to the following URL:

• https://{BLOCKED}d.com/api/webhooks/1147617604740075550/qMN4dDXG-qUd5FVw6gluS-KM8pkIs8V5dUDV8yLhHwfqs5x6Q7TeJE-qmCsn9sgTZSpX

Other Details

This Trojan Spy connects to the following URL(s) to get the affected system's IP address:

• https://{BLOCKED}ify.org

It does the following:

• It bypasses Antimalware Scan Interface (AMSI).
• It terminates, disables, and deletes the Windows Defender service if found running.
• It utilizes net.exe to create a user and add this to two local groups:
  • administrators
  • Remote Desktop Users
• It turns off the Windows Firewall for all network profiles.
• It modifies Windows Defender's settings:
  • Adds the following to the exclusion preference:
    • File Extensions:
      • .bat
      • .ppam
      • .xls
      • .docx
      • .bat
      • .exe
      • .vbs
      • .js
    • Paths:
      • C:\
      • D:\
      • E:\
    • Processes:
      • explorer.exe
      • kernel32.dll
      • aspnet_compiler.exe
      • cvtres.exe
      • CasPol.exe
      • csc.exe
      • Msbuild.exe
      • ilasm.exe
      • InstallUtil.exe
      • jsc.exe
      • Calc.exe
      • powershell.exe
      • rundll32.exe
      • conhost.exe
      • Cscript.exe
      • mshta.exe
      • cmd.exe
      • DefenderisasuckingAntivirus
      • wscript.exe
    • IP Address:
      • 127.0.0.1
  • Configures the following:
    • Threat ID Default Action
    • Attack Surface Reduction (ASR) rules
    • Default action for high-threat items
    • Default action for moderate-threat items
    • Default action for low-threat items
    • Default action for severe-threat items
  • Disables:
    • Intrusion Prevention System
    • Information Protection feature
    • Real-time monitoring
    • Scanning of scripts for malware or malicious content
    • Controlled folder access
    • Reporting to the Microsoft Active Protection Service (MAPS)
    • Sample submissions to Microsoft
    • Protection against Potentially Unwanted Applications (PUAs)
    • Scheduled scans
  • Enables:
    • Audit mode for Network Protection

It adds the following scheduled tasks:

• Task Name: clomepe
  Trigger: every 187 minutes
  Task Action: %ProgramData%\TUKHAMTASSER\NIKKIL_LORY.vbs

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)