TrojanSpy.Win32.FAKEPOC.THAOGBE

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

As of this writing, the said sites are inaccessible.

It steals certain information from the system and/or the user.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy drops the following files:

• %User Temp%\{Random Hex}.tmp\{Random Hex}.tmp\{Random Hex}.ps1 → script containing the payload and deleted after executing.

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• powershell.exe –NoProfile -ExecutionPolicy Bypass -File %User Temp%\{Random Hex}.tmp\{Random Hex}.tmp\{Random Hex}.ps1

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It creates the following folders:

• %User Temp%\{Random Hex}.tmp
• %User Temp%\{Random Hex}.tmp\{Random Hex}.tmp
• %User Temp%\{Random Filename}

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Download Routine

This Trojan Spy accesses the following websites to download files:

• https://{BLOCKED}in.com/raw/9TxS7Ldc → site containing a PowerShell code used to execute another payload.

It saves the files it downloads using the following names:

• %Windows%\{Random Filename}.ps1

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

As of this writing, the said sites are inaccessible.

Information Theft

This Trojan Spy steals the following information:

• Computer Information
• List of Current Running Processes
• Files from Downloads Folder
• Files from Documents Folder
• Files from Desktop Folder
• List of Network IPs
• List of Network Adapters
• List of Installed Software/Packages

It sends the gathered information to the following site/s using credentials from its configuration file:

• ftp://ftp.drivehq.com/wwwhome/{ZIP Filename} → it uses hardcoded login credentials to authenticate to the FTP server.

Stolen Information

This Trojan Spy saves the stolen information in the following file:

• %User Temp%\{Random Filename}\Info.txt → stores computer info
• %User Temp%\{Random Filename}\Download.txt → stores file list of Downloads folder
• %User Temp%\{Random Filename}\Documents.txt → stores file list of Documents folder
• %User Temp%\{Random Filename}\Desktop.txt → stores file list of Desktop folder
• %User Temp%\{Random Filename}\IP.txt → stores list of network IPs
• %User Temp%\{Random Filename}\NetAda.txt → stores list of network adapters
• %User Temp%\{Random Filename}\Prg.txt → stores list of installed software/packages
• %User Temp%\{Random Filename}\Proc.txt → stores process list
• %User Temp%\{Random Filename}.zip → ZIP archive containing the above files

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other Details

This Trojan Spy adds the following scheduled tasks:

• Location: \Microsoft\Windows\PowerShell\ScheduledJobs
  Name: Update
  Trigger: One time at 10:00 AM on {Scheduled Task Creation Date} → after triggered, repeat every 30 minutes indefinitely
  Action: Start a program → powershell.exe -NoLogo -NonInteractive -WindowStyle Hidden -Command "Import-Module PSScheduledJob; $jobDef = [Microsoft.PowerShell.ScheduledJob.ScheduledJobDefinition]::LoadFromStore('Update', '%AppDataLocal%\Microsoft\Windows\PowerShell\ScheduledJobs'); $jobDef.Run()"
  Properties: Hidden

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)