TrojanSpy.Win32.STEALC.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Elimina archivos para impedir la ejecución correcta de programas y aplicaciones.

Este malware no tiene ninguna rutina de propagación.

Este malware no tiene ninguna rutina de puerta trasera.

Recopila determinada información del equipo afectado.

Se conecta a determinados sitios Web para enviar y recibir información.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Este malware infiltra el/los siguiente(s) archivo(s):

• %ProgramData%\sqlite3.dll
• %ProgramData%\freebl3.dll
• %ProgramData%\mozglue.dll
• %ProgramData%\msvcp40.dll
• %ProgramData%\nss3.dll
• %ProgramData%\softokn3.dll
• %ProgramData%\vcruntime140.dll

Agrega los procesos siguientes:

• "%System%\cmd.exe" /c timeout /t 5 & del /f /q "{Malware File Path}\{Malware File Name}" & del "%ProgramData%\*.dll" & exit

Otras modificaciones del sistema

Elimina los archivos siguientes:

• {Malware File Path}\{Malware File Name}.{Malware File Extension}
• %ProgramData%\{File Name}.dll

Propagación

Este malware no tiene ninguna rutina de propagación.

Rutina de puerta trasera

Este malware no tiene ninguna rutina de puerta trasera.

Robo de información

Recopila la siguiente información del equipo afectado:

• System Information:
  • Public IP address
  • Geolocation
  • Hardware ID
  • Operating system version
  • System architecture
  • Username
  • Computer name
  • Local time
  • Time zone information
  • Language
  • Keyboard layout
  • If machine is laptop or desktop
  • {Malware File Path}\{Malware File Name}
  • Physical resources
    • CPU core count
    • CPU name
    • RAM amount
    • Number of threads
    • Display resolution
    • GPU driver
  • List of running processes
  • List of installed applications
• Screenshot of current display
• Browser data (e.g. autofills, cookies, credentials, credit card data, browser extensions)
  • Chromium-based browsers
  • Firefox-based browsers
  • Opera-based browsers
• Email credentials:
  • Outlook
• Cryptocurrency wallet data
• Telegram session data
• Steam metadata
• Discord tokens
• Account credentials:
  • Tox
  • Pidgin

Otros detalles

Se conecta al sitio Web siguiente para enviar y recibir información:

• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.7/b5c26998bb7c2272.php

Hace lo siguiente:

• It terminates itself when one of the following conditions is met:
  • If system processor count is less than 2
  • If system display raster lines is less than 666
  • If system default computer language is one of the following:
    • Russian
    • Ukranian
    • Belarussian
    • Kazakh
    • Uzbek (Latin)
  • If system computer name is HAL9TH and username is JohnDoe
  • If system total physical memory is less than 1,111 megabytes
  • If the malware is executed after August 27, 2023
• It accesses the following websites to download its configuration/component files:
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.7/b5c26998bb7c2272.php
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.7:80/714211d16652b54f/sqlite3.dll
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.7:80/714211d16652b54f/freebl3.dll
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.7:80/714211d16652b54f/mozglue.dll
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.7:80/714211d16652b54f/msvcp40.dll
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.7:80/714211d16652b54f/nss3.dll -
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.7:80/714211d16652b54f/softokn3.dll
  • http://{BLOCKED}.{BLOCKED}.{BLOCKED}.7:80/714211d16652b54f/vcruntime140.dll