TrojanSpy.Win32.VIDAR.CFC

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Löscht Dateien, so dass Programme und Anwendungen nicht ordnungsgemäß ausgeführt werden.

Diese Malware hat keine Verbreitungsroutine.

Diese Malware hat keine Backdoor-Routine.

Sammelt bestimmte Informationen auf dem betroffenen Computer.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Dateien ein:

• where gathered information is archived before exfiltrated:
  • %ProgramData%\{Random numbers}\_{Random numbers}.zip
• where gathered information is stored:
  • %ProgramData%\{Random numbers}\outlook.txt
  • %ProgramData%\{Random numbers}\passwords.txt
  where gathered information is stored:
  • %ProgramData%\{Random numbers}\outlook.txt
  • %ProgramData%\{Random numbers}\passwords.txt
  • %ProgramData%\{Random numbers}\screenshot.jpg
  • %ProgramData%\{Random numbers}\system.txt
  • %ProgramData%\{Random numbers}\temp
  • %ProgramData%\{Random numbers}\autofill\{stolen information}
  • %ProgramData%\{Random numbers}\cc\{stolen information}
  • %ProgramData%\{Random numbers}\cookies\{stolen information}
  • %ProgramData%\{Random numbers}\crypto\{Cryptocurrency name}\{stolen wallet information}
  • %ProgramData%\{Random numbers}\screenshot.jpg
  • %ProgramData%\{Random numbers}\system.txt
  • %ProgramData%\{Random numbers}\temp
  • %ProgramData%\{Random numbers}\autofill\{stolen information}
  • %ProgramData%\{Random numbers}\cc\{stolen information}
  • %ProgramData%\{Random numbers}\cookies\{stolen information}
  • %ProgramData%\{Random numbers}\crypto\{Cryptocurrency name}\{stolen wallet information}

Erstellt die folgenden Ordner:

• where stolen information is stored:
  • %ProgramData%\{Random numbers}
  • %ProgramData%\{Random numbers}\cc
  • %ProgramData%\{Random numbers}\autofill
  • %ProgramData%\{Random numbers}\cookies
  • %ProgramData%\{Random numbers}\crypto

Andere Systemänderungen

Löscht die folgenden Dateien:

• %ProgramData%\freebl3.dll
• %ProgramData%\mozglue.dll
• %ProgramData%\msvcp140.dll
• %ProgramData%\nss3.dll
• %ProgramData%\softokn3.dll
• %ProgramData%\sqlite3.dll
• %ProgramData%\vcruntime140.dll
• %ProgramData%\{Random numbers}\outlook.txt
• %ProgramData%\{Random numbers}\passwords.txt
• %ProgramData%\{Random numbers}\screenshot.jpg
• %ProgramData%\{Random numbers}\system.txt
• %ProgramData%\{Random numbers}\temp
• %ProgramData%\{Random numbers}\autofill\{stolen information}
• %ProgramData%\{Random numbers}\cc\{stolen information}
• %ProgramData%\{Random numbers}\cookies\{stolen information}
• %ProgramData%\{Random numbers}\crypto\{Cryptocurrency name}\{stolen wallet information}

Löscht die folgenden Ordner:

• after exfiltration:
  • %ProgramData%\{random numbers}
  • %ProgramData%\{random numbers}\autofill
  • %ProgramData%\{random numbers}\cc
  • %ProgramData%\{random numbers}\cookies
  • %ProgramData%\{random numbers}\crypto

Verbreitung

Diese Malware hat keine Verbreitungsroutine.

Backdoor-Routine

Diese Malware hat keine Backdoor-Routine.

Prozessbeendigung

Beendet die folgenden Prozesse im Zusammenhang mit Malware:

• /c taskkill /pid {Process ID} & erase {MalwarePath}\{Malware Name} & RD /S /Q %ProgramData%\{Random numbers}\* & exit

Datendiebstahl

Sammelt die folgenden Informationen auf dem betroffenen Computer:

• Browser data (e.g. cookies, credentials, autofills, credit card data)
  • Google Chrome
  • Chromium
  • Kometa
  • Amigo
  • Torch
  • Orbitum
  • Comodo Dragon
  • Nichrome
  • Maxthon5
  • Sputnik
  • EPB
  • Vivaldi
  • CocCoc Browser
  • Uran Browser
  • QIP Surf
  • Cent
  • Elements Browser
  • TorBro
  • Microsoft Edge
  • CryptoTab
  • Brave
  • Opera
  • Mozilla Firefox
  • Pale Moon
  • Waterfox
  • Cyberfox
  • BlackHawk
  • IceCat
  • KMeleon
  • Thunderbird
• Email credentials:
  • Outlook
• Cryptocurrency Wallet data
  • Anoncoin
  • BBQCoin
  • Bitcoin
  • DashCore
  • devcoin
  • digitalcoin
  • ElectronCash
  • Electrum
  • Electrum-LTC
  • Ethereum
  • Exodus
  • Florincoin
  • Franko
  • Freicoin
  • GoldCoinGLD
  • Infinitecoin
  • IOCoin
  • Ixcoin
  • jaxx
  • Litecoin
  • Megacoin
  • Mincoin
  • MultiDoge
  • Namecoin
  • Primecoin
  • Terracoin
  • YACoin
  • Zcash
• System Information
  • OS Version and Architecture
  • Username
  • Computer name
  • System Language
  • Machine ID
  • GUID
  • Domain Name
  • Workgroup
  • Keyboard Languages
• Hardware Information
  • Processor
  • # of Logical Processors
  • Videocard
  • Display resolution
  • RAM
  • If laptop or desktop
• Local time & zone
• Network Information
  • IP Address
  • Country
• Installed software & version
• Screenshot of current display

Andere Details

Es macht Folgendes:

• This Trojan Spy connects to the following website to send and receive information:
  • http://{BLOCKED}3g7u3EO07WT42n7f4vIn5fZH.biz
• It accesses the following websites to download its configuration/component files:
  • http://{BLOCKED}3g7u3EO07WT42n7f4vIn5fZH.biz/freebl3.dll
  • http://{BLOCKED}3g7u3EO07WT42n7f4vIn5fZH.biz/mozglue.dll
  • http://{BLOCKED}3g7u3EO07WT42n7f4vIn5fZH.biz/msvcp140.dll
  • http://{BLOCKED}3g7u3EO07WT42n7f4vIn5fZH.biz/nss3.dll
  • http://{BLOCKED}3g7u3EO07WT42n7f4vIn5fZH.biz/softokn3.dll
  • http://{BLOCKED}3g7u3EO07WT42n7f4vIn5fZH.biz/sqlite3.dll
  • http://{BLOCKED}3g7u3EO07WT42n7f4vIn5fZH.biz/vcruntime140.dll
  • http://{BLOCKED}3g7u3EO07WT42n7f4vIn5fZH.biz/main.php {configuration to collect particular files}
• It terminates itself if any of the user default language identifiers is found:
  • Kazakh (Kazakhstan)
  • Russian (Russia)
  • Ukrainian (Ukraine)
  • Belarusian (Belarus)
  • Uzbek - Latin (Uzbekistan)
  • Azeri - Cyrillic (Azerbaijan)