Backdoor.MSIL.ASYNCRAT.THABFBB

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Ejecuta comandos desde un usuario remoto malicioso que pone en peligro el sistema afectado.

Recopila determinada información del equipo afectado.

Se finaliza a sí misma si detecta que está siendo ejecutada en un entorno virtual.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Agrega las siguientes exclusiones mutuas para garantizar que solo se ejecuta una de sus copias en todo momento:

• SvchosMutex_qwqdanchun

Rutina de puerta trasera

Ejecuta los comandos siguientes desde un usuario remoto malicioso:

• Ping test
• Execute sent plugin

Robo de información

Recopila la siguiente información del equipo afectado:

• Packet = ClientInfo
• HWID = HWID generated from processor count, username, computer name, OS version, and total size of the system directory
• User = System Username
• OS = OS information
• Camera = Camera devices available
• Path = Malware installed path
• Version = {encrypted value}
• Admin = Has admin role
• Perfor_mance = {Window Title}
• Paste_bin = {encrypted value}
• Anti_virus = Installed AV products
• Install_ed = Time installed
• Po_ng = {null}
• Group = {encrypted value}

Otros detalles

Se finaliza a sí misma si detecta que está siendo ejecutada en un entorno virtual.

Hace lo siguiente:

• Upon execution it decrypts strings for its configuration:
• Key → {encrypted value}
• New Key → false
• Port → 8849
• Host → {Host to connect}
• Version → 1.0.7
• Install → false
• MTX → SvchosMutex_qwqdanchun
• Paste_bin → null
• An_ti → true
• Anti_Process → false
• BS_OD → true
• Group → Default
• HWID → {encrypted value}
• Server_signa_ture → {encrypted value}
• Certifi_cate → {encrypted value}
• VerifyHash → true
• It checks whether the System is a Windows Client or a Windows Server.
• It checks whether the System is running on x86 or x64 Windows platform.
• It retrieves information about the cache memory.
• Depending on its configuration, it is capable on executing the following functions:
• Terminating the following processes:
• Taskmgr.exe
• ProcessHacker.exe
• procexp.exe
• MSASCui.exe
• MsMpEng.exe
• MpUXSrv.exe
• MpCmdRun.exe
• NisSrv.exe
• ConfigSecurityPolicy.exe
• MSConfig.exe
• Regedit.exe
• UserAccountControlSettings.exe
• taskkill.exe
• Establish persistence with the following conditions:
• If has an admin privilege, it will create a scheduled task to execute the malware on every user log on.
• If has normal user privilege, it adds itself on start up processes by modifying system registry.
• It creates a .bat file to execute itself as a process then deletes itself after execution.