TrojanSpy.MSIL.REDENERGY.THJAOBD

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Agrega determinadas entradas de registro para desactivar el Administrador de tareas. Esta acción impide que el usuario lleve a cabo la cancelación del proceso de malware, la cual suele realizarse a través del Administrador de tareas.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• %User Temp%\{9 random alphanumeric}.jpg → desktop wallpaper after encryption
• %User Temp%\tmp{4 random alphanumeri}c.tmp.bat → terminates and deletes executed malware after encryption routine; deleted afterwards

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).

Agrega los procesos siguientes:

• vssadmin delete shadows /all /quiet & wmic shadowcopy delete
• bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
• wbadmin delete catalog -quiet
• chcp 65001
• taskkill /F /IM {pid of malware}
• timeout /T 10 /Nobreak
• Del /a /f / q {malware full path}
• Del /a /f / q {malware execution path}\DotNetZip.dll
• Del /a /f / q {malware execution path}\Newtonsoft.Json.dll

Otras modificaciones del sistema

Agrega las siguientes entradas de registro para desactivar el Administrador de tareas:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = 1

Este malware establece la imagen siguiente como fondo de escritorio del sistema:

Finalización del proceso

Finaliza los servicios siguientes si los detecta en el sistema afectado:

• BackupExecAgentBrowser
• BackupExecDiveciMediaService
• BackupExecJobEngine
• BackupExecManagementService
• vss
• sql
• svc$
• memtas
• sophos
• veeam
• backup
• GxVss
• GxBlr
• GxFWD
• GxCVD
• GxCIMgr
• DefWatch
• ccEvtMgr
• SavRoam
• RTVscan
• QBFCService
• Intuit.QuickBooks.FCS
• YooBackup
• YooIT
• zhudongfangyu
• sophos
• stc_raw_agent
• VSNAPVSS
• QBCFMonitorService
• VeeamTransportSvc
• VeeamDeploymentService
• VeeamNFSSvc
• veeam
• PDVFSService
• BackupExecVSSProvider
• BackupExecAgentAccelerator
• BackupExecRPCService
• AcrSch2Svc
• AcronisAgent
• CASAD2DWebSvc
• CAARCUpdateSvc
• TeamViewer

Robo de información

Recopila los siguientes datos:

• Username
• Hostname
• Battery Life
• Clipboard Data
• List of Installed Applications
• OS Version
• OS Product Key
• List of Installed AV Products

Otros detalles

Hace lo siguiente:

• It sets its own file attributes to SYSTEM and HIDDEN.
• It can disable the task manager.
• It terminates and deletes itself after its encryption routine.
• It loads vaultcli.dll and calls its functions to retrieve all saved data from the following browsers:
  • Opera Software
  • Edge
  • Firefox
  • Internet explorer
• It steals information from the following VPN services:
  • NordVPN
  • OpenVPN
  • ProtonVPN
• It steals information from the following email clients:
  • DeskSoft
  • Foxmail
  • GetyMail2
  • Opera_Mail
  • Outlook
  • Pocomail
  • TrulyMail
  • yMail
  • yMail2
• It steals information from the following gaming platforms installed:
  • BattleNET
  • Steam
  • Uplay
• It steals information from the following password managers:
  • Enpass
  • KeePass
  • mSecure
  • NordPass
  • _Password
  • Wallets
• It steals information from the following file transfer tools:
  • AbleFTP14
  • BlazeFtp
  • Cyberduck
  • DeluxeFTP
  • Estsoft
  • Far
  • FTPBox
  • FTPGetter
  • FTP_Now
  • FTPShell
  • GetAutomize14
  • GetFileZilla
  • GoFTP
  • INSoftware
  • iterate_GmbH
  • JaSFtp14
  • NetDrive2
  • NexusFile
  • Odin_Secure_FTP_Expert
  • SftpNetDrive
  • Staff_FTP
  • UltraFXP
  • WS_FTP
• It steals information from the following messaging platforms:
  • Discord
  • GetPaltalk
  • QQ
  • SignalGetJSON
  • SignalGetSQL
  • Skype
  • Telegram
  • TOX
  • Viber
  • Vime
  • WickrMe
  • Wickr_Pro
  • Pidgin
• It steals information from the following system/file management tools:
  • ExpanDrive
  • GetTotalCommander
  • Ipswitch
  • SuperPutty
  • Syncovery
• It steals the following browser information:
  • Web Data
  • Login Data
  • Cookies
  • History
  • History
  • Web Data
  • Bookmarks
  • CreditCards.txt
  • Passwords.txt
  • Cookies.txt
  • History.txt
  • Downloads.txt
  • AutoFill.txt
  • Bookmarks.txt