TrojanSpy.Win32.NOON.AG

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes the initially executed copy of itself.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy drops a copy of itself in the following folders using different file names:

• %Program Files%\{random name 1}\{random name 2}.exe
• %User Temp%\{random name 1}\{random name 2}.exe

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), 7 (32-bit), and 8 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), 7 (64-bit), and 8 (64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

It adds the following processes:

• {Malware filepath}\{Malware filename}

It creates the following folders:

• %Program Files%\{random name 1}
• %User Temp%\{random name 1}
• %Application Data%\N1L772RV

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), 7 (32-bit), and 8 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), 7 (64-bit), and 8 (64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, and 8.)

It injects threads into the following normal process(es):

• explorer.exe

It injects codes into the following process(es):

• {Malware filepath}\{Malware filename} (The process added by the malware)

Information Theft

This Trojan Spy gathers the following data:

• Keystrokes
• User's SID
• Operating system version
• Operating system architecture
• Username
• Clipboard content

It attempts to steal stored email credentials from the following:

• Microsoft Outlook
• Mozilla Thunderbird

It attempts to get stored information such as user names, passwords, and hostnames from the following browsers:

• Google Chrome
• Internet Explorer
• Firefox
• Opera

Stolen Information

This Trojan Spy saves the stolen information in the following file:

• %Application Data%\N1L772RV\N1Llog.ini – Keystrokes
• %Application Data%\N1L772RV\N1Llogrg.ini - Google passwords
• %Application Data%\N1L772RV\N1Llogim.jpeg - Screenshot
• %Application Data%\N1L772RV\N1Llogrv.ini - Windows Vault passwords
• %Application Data%\N1L772RV\N1Llogri.ini - Internet Explorer passwords
• %Application Data%\N1L772RV\N1Llogrf.ini - Firefox passwords
• %Application Data%\N1L772RV\N1Llogrt.ini - Thunderbird passwords
• %Application Data%\N1L772RV\N1Llogrc.ini - Outlook passwords
• %Application Data%\N1L772RV\N1Llogcl.ini - Clipboard content
• %Application Data%\N1L772RV\N1Llogro.ini - Opera passwords

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, and 8.)

It sends the gathered information via HTTP POST to the following URL:

• hxxp://www.{BLOCKED}c[.]com/ke/
• hxxp://www.{BLOCKED}lmalikitravels[.]com/ke/
• hxxp://www.{BLOCKED}ho[.]com/ke/
• hxxp://www.{BLOCKED}cil[.]com/ke/
• hxxp://www.{BLOCKED}msh[.]com/ke/
• hxxp://www.{BLOCKED}lding[.]com/ke/
• hxxp://www.{BLOCKED}omecanicaperez[.]com/ke/
• hxxp://www.{BLOCKED}edhealth[.]com/ke/
• hxxp://www.{BLOCKED}fecoach[.]com/ke/
• hxxp://www.{BLOCKED}ceoofmy.life/ke/
• hxxp://www.{BLOCKED}ero[.]com/ke/
• hxxp://www.{BLOCKED}idsphotography[.]com/ke/
• hxxp://www.{BLOCKED}duroi[.]com/ke/
• hxxp://www.{BLOCKED}yring[.]com/ke/
• hxxp://www.{BLOCKED}90[.]com/ke/
• hxxp://www.{BLOCKED}ano.group/ke/
• hxxp://www.{BLOCKED}milyfarm[.]com/ke/
• hxxp://www.{BLOCKED}x.net/ke/
• hxxp://www.{BLOCKED}i.ltd/ke/
• hxxp://www.{BLOCKED}neyoffcoupons[.]com/ke/
• hxxp://www.{BLOCKED}8[.]com/ke/
• hxxp://www.{BLOCKED}l[.]com/ke/
• hxxp://www.{BLOCKED}rybit.online/ke/
• hxxp://www.{BLOCKED}portboard[.]com/ke/
• hxxp://www.{BLOCKED}ao[.]com/ke/

Other Details

This Trojan Spy deletes the initially executed copy of itself