TrojanSpy.Win32.XWORM.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Ejecuta comandos desde un usuario remoto malicioso que pone en peligro el sistema afectado.

Registra las pulsaciones de teclas de un usuario para robar información.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• %Temporary Internet Files%\{Random Numbers}\RegAsm.exe
• %AppDataLocal%\EcoVision Dynamics\EcoScape.js
• If avastui.exe | avgui.exe | nswscsvc.exe | sophoshealth.exe is found running on the system:
  • %Temporary Internet Files%\{Random Numbers}\AutoIt3.exe
  • %Temporary Internet Files%\{Random Numbers}\R.au3
  • %AppDataLocal%\EcoVision Dynamics\A.a3x
  • %AppDataLocal%\EcoVision Dynamics\AutoIt3.exe
  Otherwise:
  • %Temporary Internet Files%\{Random Numbers}\Telecom.pif
  • %Temporary Internet Files%\{Random Numbers}\R
  • %AppDataLocal%\EcoVision Dynamics\A
  • %AppDataLocal%\EcoVision Dynamics\EcoScape.pif
• Sets the attributes to SYSTEM and HIDDEN:
  • %Temporary Internet Files%\Commander
  • %Temporary Internet Files%\Papers
  • %Temporary Internet Files%\Keyboard
  • %Temporary Internet Files%\Plugins
  • %Temporary Internet Files%\Cameras
  • %Temporary Internet Files%\Cutting.bat
  • %Temporary Internet Files%\Friends
  • %Temporary Internet Files%\Northeast
  • %Temporary Internet Files%\Fears
  • %Temporary Internet Files%\Tramadol
  • %Temporary Internet Files%\Stream

Agrega los procesos siguientes:

• "%System%\cmd.exe" /c move Cutting Cutting.bat & Cutting.bat
• tasklist
• findstr /I "wrsa.exe opssvc.exe"
• findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
• cmd /c md {Random Numbers}
• If avastui.exe | avgui.exe | nswscsvc.exe | sophoshealth.exe is found running on the system:
  • cmd /c copy /b Northeast + Cameras + Papers + Friends + Fears + Commander + Tramadol + Plugins {Random Numbers}\AutoIt3.exe
  • cmd /c copy /b Stream + Keyboard {Random Numbers}\R.au3
  • {Random Numbers}\AutoIt3.exe {Random Numbers}\R.au3
  Otherwise:
  • cmd /c copy /b Northeast + Cameras + Papers + Friends + Fears + Commander + Tramadol + Plugins {Random Numbers}\Telecom.pif
  • cmd /c copy /b Stream + Keyboard {Random Numbers}\R
  • {Random Numbers}\Telecom.pif {Random Numbers}\R
• If wrsa.exe | opssvc.exe is found running on the system:
  • ping -n 199 127.0.0.1
  Otherwise:
  • ping -n 5 127.0.0.1
• schtasks.exe /create /tn "Impaired" /tr "wscript //B '%AppDataLocal%\EcoVision Dynamics\EcoScape.js'" /sc minute /mo 3 /F

(Nota: %System% es la carpeta del sistema de Windows, que en el caso de Windows 98 y ME suele estar en C:\Windows\System, en el caso de Windows NT y 2000 en C:\WINNT\System32 y en el caso de Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) y 10(64-bit) en C:\Windows\System32).

Crea las carpetas siguientes:

• %AppDataLocal%\EcoVision Dynamics
• %Temporary Internet Files%\{Random Numbers}

Agrega las siguientes exclusiones mutuas para garantizar que solo se ejecuta una de sus copias en todo momento:

• 0vyG14tDobaS6ejo

Técnica de inicio automático

Este malware infiltra el/los archivo(s) siguiente(s) en la carpeta de inicio del usuario de Windows para permitir su ejecución automática cada vez que se inicia el sistema:

• %User Startup%\EcoScape.url
  • Which contains the following target URL:
    • file:///%AppDataLocal%/EcoVision%20Dynamics/EcoScape.js

Rutina de puerta trasera

Ejecuta los comandos siguientes desde un usuario remoto malicioso:

• pong → Sends a "pong" string to the C2
• rec → Restarts the application
• CLOSE → Closes the application
• uninstall → Executes the uninstall commands
• update → Executes the uninstall commands and the updated binary
• DW → Executes a powershell script
• FM → Executes a command from the C2 in memory
• LN → Downloads a file from a URL and execute it
• Urlopen → Opens a URL through a browser
• Urlhide → Creates a HTTP GET request
• PCShutdown → Executes a shutdown command
• PCRestart → Executes a restart command
• PCLogoff → Executes a logoff command
• RunShell → Executes a command
• StartDDos → Initiates DDoS activities
• StopDDos → Terminates DDoS activities
• StartReport → Sends a list of running processes
• StopReport → Terminates sending of running proccesses list
• Xchat → Sends a "Xchat" string and the ID generated using system information
• Hosts → Sends the drivers\etc\host file contents
• Shosts → Modifies the contents of a file
• DDos → Sends a "DDos" string to the C2
• plugin → Decompresses and executes a plugin
• savePlugin → Saves the decoded plugin to a registry then decompresses and executes it
• RemovePlugins → Deletes the registry with plugin data
• OfflineGet → Sends the contents of the keylogger file
• $cap → Sends a screen capture

Rutina de infiltración

Este malware infiltra el/los siguiente(s) archivo(s), que utiliza para su rutina de captura de teclado:

• %AppDataLocal%\Temp\Log.tmp

Robo de información

Recopila los siguientes datos:

• MD5 Hash of the following concatenated data:
  • Processor count
  • Username
  • Machine name
  • OS version
  • Total size of system drive
• Username
• OS Full Name, Version, and Architecture
• Malware's original filename → "ASGARD"
• Malware's last modification date
• True | False → if executed using the filename "USB.exe"
• True | False → if executed with admin rights
• True | False → if camera is present
• CPU Information
• GPU Information
• RAM Information
• Installed Antivirus Information
• Active Window Title

Registra las pulsaciones de teclas de un usuario para robar información.

Información sustraída

Este malware envía la información recopilada a la siguiente URL a través de HTTP POST:

• {BLOCKED}.{BLOCKED}.{BLOCKED}.142:8989

Otros detalles

Hace lo siguiente:

• It connects to the following URL that contains a text of the C&C server address:
  • https://{BLOCKED}in.com/raw/Dh8E7H3R