HKTL_NBTSCAN.GA

This hacking tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be manually installed by a user.

Arrival Details

This hacking tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be manually installed by a user.

Dropping Routine

This hacking tool drops the following files:

• {Malware Path}\{Malware's Filename}.log -> Log file that contains the information gathered by the hacktool upon connecting to the IP Range set by the malware by using the Username/Password listed on .txt files which was also set by the malware (Brute Force). The said information listed on the logs are:
  
  
  • {IP Address}|{User}|{Domain}|{Hostname}|{OS Version}|{Username that worked}|{Password that worked}|{File Copy Result}
    where:
    • {File Copy Result} could be "Success" or "Failed"
  
  Note: The default Filename for the log file is: nbt_scan.log

Other Details

This hacking tool does the following:

• This hacking tool is a command line program which is capable of scanning IP networks for NetBIOS information.
• It may list IP addresses, NetBIOS computer names, user names and MAC addresses
• Upon successful connection of the malware, it will try to copy "%System%\calc.exe" of the attacker machine to the targeted machine: "{IP with successful connection}\C$\windows\temp\fwtsqmfile0010.sqm"

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

NOTES:
It displays the following commandline instructions: