TrojanSpy.Win32.EMOTET.FEP

Se conecta a determinados sitios Web para enviar y recibir información. Este malware se elimina tras la ejecución.

Instalación

Agrega las carpetas siguientes:

• %AppDataLocal%\{string1}{string2} → if run without admin privileges

Crea las siguientes copias de sí mismo en el sistema afectado:

• %System%\{string1}{string2}.exe → if run with admin privileges
• %AppDataLocal%\{string1}{string2}\{string1}{string2}.exe → if run without admin privileges
  where {string1} and {string2} can be any of the following strings:
  • term
  • with
  • poller
  • indiana
  • shader
  • sti
  • dlgs
  • metered
  • asptlb
  • conman
  • plain
  • while
  • cpl
  • crash
  • teapot
  • device
  • adam
  • battery
  • trouble
  • caching
  • hand
  • hlf
  • hero
  • smc
  • readand
  • cpls
  • network
  • engn
  • mmc
  • lcl
  • pdh
  • clw
  • vista
  • client
  • pairs
  • fsi
  • medium
  • pdeft
  • known
  • reach
  • vert
  • boost
  • snd
  • fwk
  • builder
  • iab
  • mscms
  • ssp
  • cable
  • etw
  • angle
  • ordered
  • scalar
  • songs
  • ctnt
  • server
  • chinese
  • media
  • endif
  • supp
  • setthe
  • misc
  • diagram
  • urd

(Nota: %System% es la carpeta del sistema de Windows, que en el caso de Windows 98 y ME suele estar en C:\Windows\System, en el caso de Windows NT y 2000 en C:\WINNT\System32 y en el caso de Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) y 10(64-bit) en C:\Windows\System32).

Agrega los procesos siguientes:

• {Malware File Path}\{Malware File Name}.exe --{8 Random Characters}
• %System%\{string1}{string2}.exe → if run with admin privileges
• %System%\{string1}{string2}.exe --{8 Random Characters} → if run with admin privileges
• %AppDataLocal%\{string1}{string2}\{string1}{string2}.exe → if run without admin privileges
• %AppDataLocal%\{string1}{string2}\{string1}{string2}.exe --{8 Random Characters} → if run without admin privileges

(Nota: %System% es la carpeta del sistema de Windows, que en el caso de Windows 98 y ME suele estar en C:\Windows\System, en el caso de Windows NT y 2000 en C:\WINNT\System32 y en el caso de Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) y 10(64-bit) en C:\Windows\System32).

Agrega las siguientes exclusiones mutuas para garantizar que solo se ejecuta una de sus copias en todo momento:

• Global\I{Volume Serial Number}
• Global\M{Volume Serial Number}
• Global\E{Volume Serial Name}

Técnica de inicio automático

Elimina las siguientes claves de registro asociadas a aplicaciones antivirus y de seguridad:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\{string1}{string2}
ImagePath = %System%\{string1}{string2}.exe

Agrega las siguientes entradas de registro para permitir su ejecución automática cada vez que se inicia el sistema:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{string1}{string2} = "%AppDataLocal%\{string1}{string2}\{string1}{string2}.exe"

Otras modificaciones del sistema

Agrega las siguientes entradas de registro como parte de la rutina de instalación:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{string1}{string2}

Agrega las siguientes entradas de registro:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{string1}{string2}
Type = 16

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{string1}{string2}
Start = 2

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{string1}{string2}
ErrorControl = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{string1}{string2}
DisplayName = {string1}{string2}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{string1}{string2}
ObjectName = {string1}{string2}

Robo de información

Recopila los siguientes datos:

• Computer Name
• Process SessionId
• OS Version
• Running Processes
• File CRC
• Processor Architecture

Otros detalles

Se conecta al sitio Web siguiente para enviar y recibir información:

• • {BLOCKED}.{BLOCKED}.156.155:443/{string}
  • {BLOCKED}.{BLOCKED}.175.211:8080/{string}
  • {BLOCKED}2{BLOCKED}179.64:8080/{string}
  • {BLOCKED}.{BLOCKED}.220.155:8080/{string}
  • {BLOCKED}.{BLOCKED}170.148:8080/{string}
  • {BLOCKED}9{BLOCKED}4.210:8080/{string}
  • {BLOCKED}.{BLOCKED}.217.49:80/{string}
  • {BLOCKED}.{BLOCKED}161.166:443/{string}
  • {BLOCKED}.{BLOCKED}.72.244:53/{string}
  • {BLOCKED}.{BLOCKED}.98.115:443/{string}
  • {BLOCKED}1{BLOCKED}240.91:8080/{string}
  • {BLOCKED}.{BLOCKED}.177.26:8080/{string}
  • {BLOCKED}2{BLOCKED}19.21:8080/{string}
  • {BLOCKED}.{BLOCKED}.153.86:990/{string}
  • {BLOCKED}1{BLOCKED}194.134:443/{string}
  • {BLOCKED}.{BLOCKED}.41.136:8080/{string}
  • {BLOCKED}2{BLOCKED}215.66:8080/{string}
  • {BLOCKED}.{BLOCKED}105.223:7080/{string}
  • {BLOCKED}1{BLOCKED}245.190:8080/{string}
  • {BLOCKED}.{BLOCKED}10.37:8080/{string}
  • {BLOCKED}1{BLOCKED}59.244:20/{string}
  • {BLOCKED}.{BLOCKED}.132.213:8090/{string}
  • {BLOCKED}.{BLOCKED}.246.93:8080/{string}
  • {BLOCKED}.{BLOCKED}72.5:8080/{string}
  • {BLOCKED}7{BLOCKED}87.192:8080/{string}
  • {BLOCKED}.{BLOCKED}72.5:443/{string}
  • {BLOCKED}1{BLOCKED}7.62:7080/{string}
  • {BLOCKED}.{BLOCKED}213.192:8080/{string}
  • {BLOCKED}1{BLOCKED}43.213:8080/{string}
  • {BLOCKED}.{BLOCKED}71.72:8080/{string}
  • {BLOCKED}2{BLOCKED}216.44:8080/{string}
  • {BLOCKED}.{BLOCKED}.24.79:8080/{string}
  • {BLOCKED}.{BLOCKED}.203.26:8080/{string}
  • {BLOCKED}4{BLOCKED}13.2:22/{string}
  • {BLOCKED}2{BLOCKED}21.170:80/{string}
  • {BLOCKED}1{BLOCKED}216.217:8080/{string}
  • {BLOCKED}.{BLOCKED}.47.77:8080/{string}
  • {BLOCKED}.{BLOCKED}200.130:8080/{string}
  • {BLOCKED}.{BLOCKED}.194.138:443/{string}
  • {BLOCKED}.{BLOCKED}.51.222:8080/{string}
  • {BLOCKED}2{BLOCKED}19.147:8080/{string}
  • {BLOCKED}1{BLOCKED}131.87:80/{string}
  • {BLOCKED}3{BLOCKED}9.124:443/{string}
  • {BLOCKED}.{BLOCKED}.182.217:8080/{string}
  • {BLOCKED}.{BLOCKED}148.138:8080/{string}
  • {BLOCKED}.{BLOCKED}241.230:80/{string}
  • {BLOCKED}.{BLOCKED}.182.191:8080/{string}
  • {BLOCKED}.{BLOCKED}213.158:8080/{string}
  • {BLOCKED}1{BLOCKED}136.232:8080/{string}
  • {BLOCKED}.{BLOCKED}.98.125:8080/{string}
  • {BLOCKED}.{BLOCKED}.11.150:8080/{string}
  • {BLOCKED}1{BLOCKED}2.199:443/{string}
  • {BLOCKED}.{BLOCKED}131.88:80/{string}
  • {BLOCKED}.{BLOCKED}95.230:443/{string}
  • {BLOCKED}.{BLOCKED}.207.11:443/{string}
  • {BLOCKED}.{BLOCKED}.140.110:8080/{string}
  • {BLOCKED}.{BLOCKED}.44.150:8080/{string}
  • {BLOCKED}.{BLOCKED}.67.134:8090/{string}
  • {BLOCKED}.{BLOCKED}72.5:20/{string}
  • {BLOCKED}.{BLOCKED}193.14:80/{string}
  • {BLOCKED}1{BLOCKED}63.139:21/{string}
  • {BLOCKED}.{BLOCKED}135.159:21/{string}
  • {BLOCKED}.{BLOCKED}94.251:80/{string}
  • {BLOCKED}.{BLOCKED}.238.69:465/{string}
  • {BLOCKED}.{BLOCKED}234.16:8080/{string}
  • {BLOCKED}1{BLOCKED}139.101:8080/{string}
  • {BLOCKED}2{BLOCKED}247.10:80/{string}
  • {BLOCKED}.{BLOCKED}.44.20:21/{string}
  • {BLOCKED}.{BLOCKED}63.1:80/{string}
  • {BLOCKED}1{BLOCKED}164.174:80/{string}
  • {BLOCKED}.{BLOCKED}.153.252:8080/{string
  • {BLOCKED}.{BLOCKED}236.214:8080/{string}
  • {BLOCKED}.{BLOCKED}.247.220:80/{string}
  • {BLOCKED}.{BLOCKED}25.128:8080/{string}
• where {string} can be one or a combination of any of the following strings, separated by "/":
  • teapot
  • pnp
  • tpt
  • splash
  • site
  • codec
  • health
  • balloon
  • cab
  • odbc
  • badge
  • dma
  • psec
  • cookies
  • iplk
  • devices
  • enable
  • mult
  • prov
  • vermont
  • attrib
  • schema
  • iab
  • chunk
  • publish
  • prep
  • srvc
  • sess
  • ringin
  • nsip
  • stubs
  • img
  • add
  • xian
  • jit
  • free
  • pdf
  • loadan
  • arizona
  • tlb
  • forced
  • results
  • symbols
  • report
  • guids
  • taskbar
  • child
  • cone
  • glitch
  • entries
  • between
  • bml
  • usbccid
  • sym
  • enabled
  • merge
  • window
  • scripts
  • raster
  • acquire
  • json
  • rtm
  • walk
  • ban

Este malware se elimina tras la ejecución.