TrojanSpy.Win32.FAUXPERSKY.AA

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Elimina archivos para impedir la ejecución correcta de programas y aplicaciones.

Se conecta a determinados sitios Web para enviar y recibir información.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Agrega los procesos siguientes:

• %System%\cmd.exe /c ping -n 1 -w 1000 www.google.com.my>Ping.sb → checks internet connection
• {Malware file path}\winlogin.exe → if not running in the system
• %AppData%\Temp.exe → if file is downloaded successfully

Otras modificaciones del sistema

Elimina los archivos siguientes:

• {Malware file path}\S_Core.txt
• {Malware file path}\S_CMD.txt
• {Malware file path}\S_PTC.txt

Finalización del proceso

Finaliza los procesos siguientes si detecta que se ejecutan en la memoria del sistema afectado:

• msiexec.exe

Rutina de descarga

Accede a los siguientes sitios Web para descargar archivos:

• https://kasperskypure.{BLOCKED}pp.com/S_Core.txt
• https://kasperskypure.{BLOCKED}pp.com/S_CMD.txt
• https://kasperskypure.{BLOCKED}pp.com/S_PTC.txt
• https://kasperskypure.{BLOCKED}pp.com/spoolsvc.exe → downloaded to update existing files in the system
• https://kasperskypure.{BLOCKED}pp.com/Temp.exe → downloaded to update existing files in the system

Guarda los archivos que descarga con los nombres siguientes:

• {Malware file path}\S_Core.txt
• {Malware file path}\S_CMD.txt
• {Malware file path}\S_PTC.txt
• {Malware file path}\spoolsvc.exe
• %AppData%\Temp.exe

Robo de información

Recopila los siguientes datos:

• OS Version
• Computer Name
• User Name
• IP Address
• Content:
  • Update number of downloaded files, spoolsvc.exe and Temp.exe
  • Success message if execution of downloaded files are successful

Otros detalles

Se conecta al sitio Web siguiente para enviar y recibir información:

• https://docs.google.com/forms/d/e/{BLOCKED}LSe6oGStKSshScVonAyCVFOrhANSfnmm0Im-aabnBX5ZjLabbA/viewform?entry.{BLOCKED}914=%A_OSVersion%&entry.{BLOCKED}477=%A_ComputerName%&entry.{BLOCKED}695=%A_UserName%&entry.{BLOCKED}0660=%A_IPAddress1%

Hace lo siguiente:

• It checks the contents of Ping.sb if it contains the string "could not find".
  • If found, it repeatedly checks for internet connection.
• It checks if all the components of the malware are already running.
• It checks if the following files are present in the directory where the sample is located:
  • winlogin.exe → executed if found
  • spoolsvc.exe
    • If found:
      • It compares the last update time of spoolsvc.exe with S_Core.txt.
      • If outdated, it downloads the updated version of the file.
• It checks if the following files are present in %AppData%:
  • Temp.exe
    • It downloads the file if not found.
    • It compares the last update time of Temp.exe with S_CMD.txt.
    • If outdated, it downloads the updated version of the file.
• It sets the file attributes of the following files to Read-Only, Hidden, and System:
  • {Malware file path}\spoolsvc.exe
  • %AppData%\Temp.exe
• It exfiltrates information via Google Forms.