TrojanSpy.PS1.DATASPY.C

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It gathers certain information on the affected computer.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Information Theft

This Trojan Spy gathers the following information on the affected computer:

• Fixed Drives
• Machine Name

Stolen Information

This Trojan Spy sends the gathered information via HTTP POST to the following URL:

• http://(BLOCKED}.{BLOCKED}.100.46:443/upload/?dir={id}/{token}/{Machine Name}/{Drive Letter}{Full Path}

Other Details

This Trojan Spy does the following:

• It searches for files to exfiltrate in Fixed Drives.
• It uploads files from folders without the following strings in its path:
  • *.cargo*
  • *.gradle*
  • *{*
  • *}*
  • *apache-ant*
  • *Backup*
  • *Backup*
  • *Boot*
  • *Chrome*
  • *Delete*
  • *ESET*
  • *inetpub*
  • *libarchive*
  • *Logs*
  • *Microsoft*
  • *MinGW*
  • *Mozilla*
  • *msys64*
  • *mysql-connector*
  • *old*
  • *Package Cache*
  • *Packages*
  • *PerfLogs*
  • *pris_temp*
  • *Program Files*
  • *ProgramData*
  • *Recovery*
  • *Request*
  • *Ruby*
  • *Snap*
  • *Sophos*
  • *svm-map*
  • *Symantec*
  • *System Volume Information*
  • *System*
  • *TDM-GCC*
  • *VMMShare*
  • *VMWare*
  • *Windows*
  • *WindowsAzure*
• It uploads files with the following strings:
  • *abuse*
  • *Addres*
  • *agreem*
  • *Agreemen*Disclosur*
  • *assault*
  • *Assignment*
  • *attack*
  • *Audit*
  • *balanc*
  • *bank*
  • *Bank*Statement*
  • *budget*
  • *card*
  • *cash*
  • *compromate*
  • *confid*
  • *Confidential*Disclosure*
  • *contact*
  • *contract*
  • *Crime*
  • *crit*
  • *critical*
  • *dead*
  • *death*
  • *director*
  • *employment*
  • *Enrol*
  • *federal*
  • *federal*
  • *Finan*
  • *Forbidden*
  • *fraud*
  • *government*
  • *harassment*
  • *humiliation*
  • *identi*
  • *illegal*
  • *important*
  • *Incident*
  • *individual*
  • *injury*
  • *Insurance*
  • *intima*
  • *investigation*
  • *kill*
  • *Legal*
  • *Login*
  • *Medic*
  • *pasaporte*
  • *paspoort*
  • *pasport*
  • *passaporto*
  • *passeport*
  • *passport*
  • *password*
  • *patient*
  • *pay*
  • *payment*
  • *payroll*
  • *Personal*
  • *Private*
  • *Recruitment*
  • *Reisepass*
  • *report*
  • *Resour*
  • *Resources*Human*
  • *resurses*human*
  • *Revenue*
  • *scan*
  • *secret*
  • *security*
  • *sex*
  • *sexual*
  • *Social*Number*
  • *statement*
  • *Statement*Bank*
  • *Stealing*
  • *SWIFT*
  • *Terror*
  • *Theft*
  • *Transact*
  • *violence*
• It does not send files with the following strings:
  • *. rpt
  • *.accdb
  • *.ai
  • *.aiff
  • *.ap_
  • *.apk
  • *.application
  • *.asc
  • *.ascx
  • *.aspx
  • *.ass
  • *.au
  • *.avi
  • *.axd
  • *.bac
  • *.bak
  • *.bat
  • *.bkf
  • *.bkp
  • *.bkp
  • *.blog
  • *.bmp
  • *.bundled
  • *.c
  • *.cab
  • *.cab
  • *.cat
  • *.cch
  • *.cdf-ms
  • *.cdpresource
  • *.cdpresource
  • *.cdxml
  • *.cfm
  • *.checksum
  • *.chg
  • *.chm
  • *.chw
  • *.class
  • *.cls
  • *.cmd
  • *.config
  • *.contact
  • *.cpi
  • *.cr2
  • *.cs
  • *.cshtml
  • *.csproj
  • *.css
  • *.cvs
  • *.dat
  • *.dbf
  • *.deploy
  • *.DIC
  • *.dif
  • *.diz
  • *.dll
  • *.dotm
  • *.dtd
  • *.ed1
  • *.efi
  • *.emf
  • *.eps
  • *.epub
  • *.etl
  • *.evtx
  • *.exe
  • *.fm3
  • *.form
  • *.fp5
  • *.frm
  • *.function
  • *.function
  • *.gif
  • *.glox
  • *.gm
  • *.gz
  • *.h
  • *.hlp
  • *.hqx
  • *.hro
  • *.htm*
  • *.htm*
  • *.html
  • *.ico
  • *.idml*
  • *.IDX
  • *.indd
  • *.inf
  • *.info
  • *.ini
  • *.ipa
  • *.jar
  • *.java
  • *.jfm
  • *.js
  • *.jsm
  • *.json
  • *.jsonlz4
  • *.jsp
  • *.jss
  • *.kit*
  • *.ldf
  • *.leveldb
  • *.lnk
  • *.log
  • *.log
  • *.lua
  • *.m4a
  • *.man
  • *.manifest
  • *.map
  • *.md
  • *.md5
  • *.mdb
  • *.mid
  • *.midi
  • *.modd
  • *.mof
  • *.mov
  • *.mp3
  • *.mp3
  • *.mp4
  • *.msc
  • *.msg
  • *.msi
  • *.msm
  • *.msp
  • *.mst
  • *.mui
  • *.NEF
  • *.nib
  • *.node
  • *.nse
  • *.nupkg
  • *.nupkg
  • *.oab
  • *.obj
  • *.osxp
  • *.pbk
  • *.pdb
  • *.pfl
  • *.pfx
  • *.php
  • *.Pid
  • *.pkf
  • *.pls
  • *.potx
  • *.pp
  • *.ppt
  • *.pptx
  • *.procedure
  • *.properties
  • *.ps1
  • *.ps1xml
  • *.psd
  • *.psd1
  • *.psp
  • *.py
  • *.pyc
  • *.qm
  • *.qxd
  • *.ra
  • *.rb
  • *.rdp
  • *.resources
  • *.rll
  • *.sch
  • *.security
  • *.sit
  • *.so
  • *.soc
  • *.sqlite
  • *.su
  • *.suo
  • *.svc
  • *.swf
  • *.sys
  • *.table
  • *.tar
  • *.template
  • *.thmx
  • *.tif
  • *.tiff
  • *.tmp
  • *.tpl
  • *.trn
  • *.tt
  • *.txt
  • *.url
  • *.vb
  • *.vbs
  • *.vbs
  • *.vcf
  • *.vcf
  • *.VDI
  • *.vsdx
  • *.vsix
  • *.wav
  • *.wer
  • *.wk3
  • *.wmf
  • *.wsdl
  • *.x32
  • *.xml
  • *.xrm-ms
  • *.xsd
  • *_metadata
  • *{*
  • *}*
  • *acrodata
  • *AppData/Roaming*
  • *Boot*
  • *cache
  • *download
  • *ESET*
  • *Microsoft*
  • *Mozilla*
  • *Package Cache*
  • *Program Files*
  • *ProgramData*
  • *recicle*
  • *Recovery*
  • *Sophos*
  • *Symantec*
  • *System Volume Information*
  • *temp
  • *VMWare*
  • *Windows*

However, as of this writing, the said sites are inaccessible.