Backdoor.Win64.TRUEBOT.YXDDY
Trojan:Win64/TrueBot!MSR (MICROSOFT); UDS:Trojan.Win32.GenericML.xnet (KASPERSKY)
Windows
Threat Type: Backdoor
Destructiveness: No
Encrypted: No
In the wild: Yes
OVERVIEW
This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It executes commands from a remote malicious user, effectively compromising the affected system. However, as of this writing, the said sites are inaccessible.
TECHNICAL DETAILS
1,427,920 bytes
DLL
No
25 Apr 2023
Arrival Details
This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This Backdoor adds the following mutexes to ensure that only one of its copies runs at any one time:
- ASPODIKAFLKJoieLUFESJFuiewr
Backdoor Routine
This Backdoor executes the following commands from a remote malicious user:
- KLLS - terminate processes via cmd
- SHC - execute shellcode
- S64 - execute shellcode
It connects to the following URL(s) to send and receive commands from a remote malicious user:
- http://{BLOCKED}.com/dns.php
However, as of this writing, the said sites are inaccessible.
Dropping Routine
This Backdoor drops the following files:
- %All Users Profile%\{Random}.JSONIP - contains generated ID with format {0-9a-z}{8}-{0-9a-z}{8}
(Note: %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). )
Information Theft
This Backdoor gathers the following data:
- Computer Name
- Workstation Information
- OS version
- System Architecture
Other Details
This Backdoor connects to the following URL(s) to check for an Internet connection:
- google.com
It checks for the presence of the following process(es):
- All running processes without the following strings in its filename:
- AUDI
- AUDIODG
- CMD
- CONHOST
- CSRSS
- CTFMON
- DLLHOST
- DWM
- FONTDRVHOST
- IBMPM
- IGFX
- LMS
- LSASS
- LSM
- MEMORY
- PLUGINHOST
- POWERMGR
- PRESENTATIONFONTCACHE
- REGISTRY
- RUNDLL32
- RUNTIMEBROKER
- SERVICE
- SHELLEXPERIENCEHOST
- SIHOST
- SMSS
- SPLWOW64
- SPOOLSV
- STARTMENUEXPERIENCEHOST
- SVCHOST
- SYSTEM
- TABTIP
- TASKHOSTW
- TASKLIST
- TEXTINPUTHOST
- TIWORKER
- TRUSTEDINSTALLER
- USEROOBEBROKER
- WININIT
- WINLOGON
- WLANEXT
- WUDFHOST
It does the following:
- It checks for the presence of the following files upon execution:
- FODSIKFODSIOFKDSOIFOSDIFODS.doc
- %All Users Profile%\SqSjdQgzWPdzH.JSONIP
- It sends the gathered information and listed processes to its CnC.
(Note: %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). )
It adds the following scheduled tasks:
- Task Name: MicrosoftEdgeUpdateTaskMachineCore{1575CC8A-457A-1700-652A-6BF2B031A266}
Task to be run: %SysWOW64%\rundll32.exe /S {Malware File Path}\{Malware File Name},ChkdskExs - Task Name: MicrosoftEdgeUpdateTaskMachineCore{1575CC8A-457A-1700-652A-6AF2B031A266}
Task to be run: %SysWOW64%\rundll32.exe /S {Malware File Path}\{Malware File Name},ChkdskExs
SOLUTION
9.800
18.408.08
26 Apr 2023
18.409.00
27 Apr 2023
Step 1
Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.
Step 2
Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.
Step 3
Restart in Safe Mode
Step 4
Deleting Scheduled Tasks
The following {Task Name} - {Task to be run} listed should be used in the steps identified below:
- Task Name: MicrosoftEdgeUpdateTaskMachineCore{1575CC8A-457A-1700-652A-6BF2B031A266}
Task to be run: %SysWOW64%\rundll32.exe /S {Malware File Path}\{Malware File Name},ChkdskExs - Task Name: MicrosoftEdgeUpdateTaskMachineCore{1575CC8A-457A-1700-652A-6AF2B031A266}
Task to be run: %SysWOW64%\rundll32.exe /S {Malware File Path}\{Malware File Name},ChkdskExs
For Windows 2000, Windows XP, and Windows Server 2003:
- Open the Windows Scheduled Tasks. Click Start>Programs>Accessories>
System Tools>Scheduled Tasks. - Locate each {Task Name} values listed above in the Name column.
- Right-click on the said file(s) with the aforementioned value.
- Click on Properties. In the Run field, check for the listed {Task to be run}.
- If the strings match the list above, delete the task.
For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:
- Open the Windows Task Scheduler. To do this:
• On Windows Vista, Windows 7, and Windows Server 2008, click Start, type taskschd.msc in the Search input field, then press Enter.
• On Windows 8, Windows 8.1, and Windows Server 2012, right-click on the lower left corner of the screen, click Run, type taskschd.msc, then press Enter. - In the left panel, click Task Scheduler Library.
- In the upper-middle panel, locate each {Task Name} values listed above in the Name column.
- In the lower-middle panel, click the Actions tab. In the Details column, check for the {Task to be run} string.
- If the said string is found, delete the task.
Step 5
Search and delete these files
- %All Users Profile%\{Random}.JSONIP
Step 6
Restart in normal mode and scan your computer with your Trend Micro product for files detected as Backdoor.Win64.TRUEBOT.YXDDY. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.