TrojanSpy.Win32.XWORM.A

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It logs a user's keystrokes to steal information.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy drops the following files:

• %Temporary Internet Files%\{Random Numbers}\RegAsm.exe
• %AppDataLocal%\EcoVision Dynamics\EcoScape.js
• If avastui.exe | avgui.exe | nswscsvc.exe | sophoshealth.exe is found running on the system:
  • %Temporary Internet Files%\{Random Numbers}\AutoIt3.exe
  • %Temporary Internet Files%\{Random Numbers}\R.au3
  • %AppDataLocal%\EcoVision Dynamics\A.a3x
  • %AppDataLocal%\EcoVision Dynamics\AutoIt3.exe
  Otherwise:
  • %Temporary Internet Files%\{Random Numbers}\Telecom.pif
  • %Temporary Internet Files%\{Random Numbers}\R
  • %AppDataLocal%\EcoVision Dynamics\A
  • %AppDataLocal%\EcoVision Dynamics\EcoScape.pif
• Sets the attributes to SYSTEM and HIDDEN:
  • %Temporary Internet Files%\Commander
  • %Temporary Internet Files%\Papers
  • %Temporary Internet Files%\Keyboard
  • %Temporary Internet Files%\Plugins
  • %Temporary Internet Files%\Cameras
  • %Temporary Internet Files%\Cutting.bat
  • %Temporary Internet Files%\Friends
  • %Temporary Internet Files%\Northeast
  • %Temporary Internet Files%\Fears
  • %Temporary Internet Files%\Tramadol
  • %Temporary Internet Files%\Stream

(Note: %Temporary Internet Files% is the Temporary Internet Files folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temporary Internet Files on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Microsoft\Windows\Temporary Internet Files on Windows Vista, 7 and 2008(64-bit), or C:\Users\{user name}\AppData\Local\Microsoft\Windows\INetCache on Windows 8, 8.1, 2012(64-bit) and 10(64-bit).. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• "%System%\cmd.exe" /c move Cutting Cutting.bat & Cutting.bat
• tasklist
• findstr /I "wrsa.exe opssvc.exe"
• findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
• cmd /c md {Random Numbers}
• If avastui.exe | avgui.exe | nswscsvc.exe | sophoshealth.exe is found running on the system:
  • cmd /c copy /b Northeast + Cameras + Papers + Friends + Fears + Commander + Tramadol + Plugins {Random Numbers}\AutoIt3.exe
  • cmd /c copy /b Stream + Keyboard {Random Numbers}\R.au3
  • {Random Numbers}\AutoIt3.exe {Random Numbers}\R.au3
  Otherwise:
  • cmd /c copy /b Northeast + Cameras + Papers + Friends + Fears + Commander + Tramadol + Plugins {Random Numbers}\Telecom.pif
  • cmd /c copy /b Stream + Keyboard {Random Numbers}\R
  • {Random Numbers}\Telecom.pif {Random Numbers}\R
• If wrsa.exe | opssvc.exe is found running on the system:
  • ping -n 199 127.0.0.1
  Otherwise:
  • ping -n 5 127.0.0.1
• schtasks.exe /create /tn "Impaired" /tr "wscript //B '%AppDataLocal%\EcoVision Dynamics\EcoScape.js'" /sc minute /mo 3 /F

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It creates the following folders:

• %AppDataLocal%\EcoVision Dynamics
• %Temporary Internet Files%\{Random Numbers}

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Temporary Internet Files% is the Temporary Internet Files folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temporary Internet Files on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Microsoft\Windows\Temporary Internet Files on Windows Vista, 7 and 2008(64-bit), or C:\Users\{user name}\AppData\Local\Microsoft\Windows\INetCache on Windows 8, 8.1, 2012(64-bit) and 10(64-bit).)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• 0vyG14tDobaS6ejo

Autostart Technique

This Trojan Spy drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\EcoScape.url
  • Which contains the following target URL:
    • file:///%AppDataLocal%/EcoVision%20Dynamics/EcoScape.js

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Backdoor Routine

This Trojan Spy executes the following commands from a remote malicious user:

• pong → Sends a "pong" string to the C2
• rec → Restarts the application
• CLOSE → Closes the application
• uninstall → Executes the uninstall commands
• update → Executes the uninstall commands and the updated binary
• DW → Executes a powershell script
• FM → Executes a command from the C2 in memory
• LN → Downloads a file from a URL and execute it
• Urlopen → Opens a URL through a browser
• Urlhide → Creates a HTTP GET request
• PCShutdown → Executes a shutdown command
• PCRestart → Executes a restart command
• PCLogoff → Executes a logoff command
• RunShell → Executes a command
• StartDDos → Initiates DDoS activities
• StopDDos → Terminates DDoS activities
• StartReport → Sends a list of running processes
• StopReport → Terminates sending of running proccesses list
• Xchat → Sends a "Xchat" string and the ID generated using system information
• Hosts → Sends the drivers\etc\host file contents
• Shosts → Modifies the contents of a file
• DDos → Sends a "DDos" string to the C2
• plugin → Decompresses and executes a plugin
• savePlugin → Saves the decoded plugin to a registry then decompresses and executes it
• RemovePlugins → Deletes the registry with plugin data
• OfflineGet → Sends the contents of the keylogger file
• $cap → Sends a screen capture

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.{BLOCKED}.{BLOCKED}.142:8989

Dropping Routine

This Trojan Spy drops the following file(s), which it uses for its keylogging routine:

• %AppDataLocal%\Temp\Log.tmp

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Information Theft

This Trojan Spy gathers the following data:

• MD5 Hash of the following concatenated data:
  • Processor count
  • Username
  • Machine name
  • OS version
  • Total size of system drive
• Username
• OS Full Name, Version, and Architecture
• Malware's original filename → "ASGARD"
• Malware's last modification date
• True | False → if executed using the filename "USB.exe"
• True | False → if executed with admin rights
• True | False → if camera is present
• CPU Information
• GPU Information
• RAM Information
• Installed Antivirus Information
• Active Window Title

It logs a user's keystrokes to steal information.

Stolen Information

This Trojan Spy sends the gathered information via HTTP POST to the following URL:

• {BLOCKED}.{BLOCKED}.{BLOCKED}.142:8989

Other Details

This Trojan Spy checks for the presence of the following process(es):

• wrsa.exe
• opssvc.exe
• avastui.exe
• avgui.exe
• nswscsvc.exe
• sophoshealth.exe

It does the following:

• It connects to the following URL that contains a text of the C&C server address:
  • https://{BLOCKED}in.com/raw/Dh8E7H3R

It adds the following scheduled tasks:

• Location: {Scheduled Task Root Directory}
  Task Name: Impaired
  Trigger: One Time (from creation date, triggers every 3 minutes indefinitely)
  Action: Start a program - wscript //B "%AppDataLocal%\EcoVision Dynamics\EcoScape.js"

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)