TrojanSpy.Win32.REDAMAN.AA

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy adds the following processes:

• rundll32 core.dll,DllGetClassObject root 000000000000
• rundll32 "%ProgramData%\{1st set of random characters}\{2nd set of random characters}.dat", DllGetClassObject root

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)

It creates the following folders:

• %ProgramData%\{random characters}
• %User Temp%\IXP000.TMP

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Autostart Technique

This Trojan Spy adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\RunOnce
wextract_cleanup0 = "rundll32.exe %System%\advpack.dll, DelNodeRunDLL32 "%User Temp%\IXP000.TMP""

Other System Modifications

This Trojan Spy adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\{12 random characters}
{Random Characters} = {Hex Values}

Dropping Routine

This Trojan Spy drops the following files:

• %User Temp%\IXP000.TMP\core.dll
• %ProgramData%\{1st set of random characters}\{2nd set of random characters}.dat

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)

Stolen Information

This Trojan Spy sends the gathered information via HTTP POST to the following URL:

• http://{BLOCKED}ezguvk9qq5js/index.php

Other Details

This Trojan Spy does the following:

• Checks if the DLL component is run by any of the following:
  • t.exe
  • self.exe
  • myapp.exe
• Terminates itself if any of the following directories is found in the victim's machine as part of its evasion technique:
  • (C: or D:)\cuckoo
  • (C: or D:)\fake_drive
  • (C: or D:)\perl
  • (C: or D:)\strawberry
  • (C: or D:)\targets.xls
  • (C: or D:)\tsl
  • (C: or D:)\wget.exe
  • (C: or D:)\python
• Renames the following file after execution:
  • %User Temp%\IXP000.TMP\core.dll -> %User Temp%\IXP000.TMP\{random characters}
• It monitors the user's banking activies by checking the browser for the following strings which are related to banking sites:
  • Sberbank
  • BSS
  • Faktura
  • PCB
  • InterPro
  • RosBank
  • SBBO
  • INIST
  • Inversion
  • InterBank
  • iBank2
  • BiCrypt
  • VTB24
  • SGB
  • HandyBank
  • CFT
  • Clbank
  • QiwiCashier
  • WebMoney
  • iFOBS
  • Raiffeisen
  • Minbank
  • SFT
  • MDM
  • Alfa
  • Avangard
  • Intercassa
  • Vuzbank
  • UBRR
  • Modulbank
  • CentrInvest
  • MTSBank
  • MKB
  • BSPB
  • RSHB
  • MMBank
  • BlockchainInfo
  • Infocrypt
  • online.payment.ru
  • bankline.ru
  • faktura.ru
  • ibank2
  • bco.vtb24
  • bo.vtb24
  • dbo.vtb24
  • elbrus.raiffeisen
  • elba.raiffeisen
  • handybank
  • wupos.westernunion
  • online.sberbank
  • minbank.ru
  • e-plat.mdmbank
  • link.alfabank
  • click.alfabank
  • ib.avangard
  • ibc.vuzbank
  • ibc.ubrr
  • my.modulbank
  • online.centrinvest
  • cb.mtsbank
  • vbo.mkb
  • i.bspb.ru
  • i.vtb.ru
  • bc.rshb
  • sci.interkassa
  • ibank.mmbank
  • blockchain.info
  • /wallet/
  • /vpnkeylocal
• It is capable of the following:
  • Keylogging activity
  • Download files to the victim's machine
  • Reboot/shutdown victim's machine
  • Capture screenshots and record videos of the victim's Desktop
  • Smart card monitoring
  • Acquire clipboard data
  • Terminate processes
  • Scan DNS servers
  • Alter DNS configuration via Windows hosts file
  • Add certificates to Windows store

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)