Trojan.Win64.DOWNLOADER.O

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Este malware no tiene ninguna rutina de propagación.

Este malware no tiene ninguna rutina de puerta trasera.

Recopila información específica del sistema afectado.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Agrega las siguientes exclusiones mutuas para garantizar que solo se ejecuta una de sus copias en todo momento:

• c88b0910ed61c17a780135d615c43ef6917616749

Propagación

Este malware no tiene ninguna rutina de propagación.

Rutina de puerta trasera

Este malware no tiene ninguna rutina de puerta trasera.

Robo de información

Recopila la siguiente información del sistema afectado:

• Hostname
• Locale Info

Otros detalles

Hace lo siguiente:

• It impersonates the logged on user.
• It uses the following URL to use Slack's API for its malicious purposes:
  • https://{BLOCKED}k.com/api/conversations.list?exclude_archived=true → lists all the conversations(channels, direct messages, and group chats) available in the Slack workspace
  • https://{BLOCKED}k.com/api/files.upload?&channels={channel ID} → uploads a file to one or more channels, direct messages in the Slack workspace
  • https://{BLOCKED}k.com/api/conversations.create → creates a new channel (public or private) in the Slack workspace
  • https://{BLOCKED}k.com/api/conversations.update → updates the settings of an existing Slack channel
  • https://{BLOCKED}k.com/api/conversations.delete → delete a Slack channel (public or private)
  • https://{BLOCKED}k.com/api/conversations.postMessage → sends a message to a specific conversation in Slack workspace
  • https://{BLOCKED}k.com/api/conversations.history?limit=200&channel={channel ID} → retrieves the past 200 messages from a specified Slack channel (public or private)
• It retrieves its encrypted component to communicate with Slack workspace using the following URL:
  • https://{BLOCKED}ell.io/notes/58434-3
  • https://{BLOCKED}l.xlog.app/page1
• The Slack communication was established through the use of this hardcoded authentication token:
  • {BLOCKED}19976938784-7094277537125-7090647648246-e3a9e4feeb2fe448f889890be6e1299e → Inaccessible; Token revoked