TrojanSpy.Win32.OYSTERLOADER.A

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It gathers certain information on the affected computer.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy adds the following processes:

• schtasks /create /tn ClearMngs /tr "rundll32.exe \"{Malware File Path}\",Test" /sc hourly /mo 3 /f

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• ITrkfSaV-4c7KwdfnC-Ds165XU4C-lH6R9pk1

Information Theft

This Trojan Spy gathers the following information on the affected computer:

• Username
• Computer Name
• User Information
• Operating System
• IP address
• Domain name
• User Privilege

Stolen Information

This Trojan Spy sends the gathered information via HTTP POST to the following URL:

• http://{BLOCKED}ndrysettlers.us
• http://{BLOCKED}erhomebe.com
• http://{BLOCKED}ectyourman.eu

Other Details

This Trojan Spy does the following:

• It adds the following schedule tasks:
  • Location:{Schedule Tasks Root Directory}
  • Name: ClearMngs
  • Trigger: At {Time execution of malware} on {Date execution of malware} - After triggered, repeat every 03:00 indefinitely.
  • Action Start a program - rundll32 "{Malware File Path},Test