TrojanSpy.PS1.DATASPY.C

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Recopila determinada información del equipo afectado.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Robo de información

Recopila la siguiente información del equipo afectado:

• Fixed Drives
• Machine Name

Información sustraída

Este malware envía la información recopilada a la siguiente URL a través de HTTP POST:

• http://(BLOCKED}.{BLOCKED}.100.46:443/upload/?dir={id}/{token}/{Machine Name}/{Drive Letter}{Full Path}

Otros detalles

Hace lo siguiente:

• It searches for files to exfiltrate in Fixed Drives.
• It uploads files from folders without the following strings in its path:
  • *.cargo*
  • *.gradle*
  • *{*
  • *}*
  • *apache-ant*
  • *Backup*
  • *Backup*
  • *Boot*
  • *Chrome*
  • *Delete*
  • *ESET*
  • *inetpub*
  • *libarchive*
  • *Logs*
  • *Microsoft*
  • *MinGW*
  • *Mozilla*
  • *msys64*
  • *mysql-connector*
  • *old*
  • *Package Cache*
  • *Packages*
  • *PerfLogs*
  • *pris_temp*
  • *Program Files*
  • *ProgramData*
  • *Recovery*
  • *Request*
  • *Ruby*
  • *Snap*
  • *Sophos*
  • *svm-map*
  • *Symantec*
  • *System Volume Information*
  • *System*
  • *TDM-GCC*
  • *VMMShare*
  • *VMWare*
  • *Windows*
  • *WindowsAzure*
• It uploads files with the following strings:
  • *abuse*
  • *Addres*
  • *agreem*
  • *Agreemen*Disclosur*
  • *assault*
  • *Assignment*
  • *attack*
  • *Audit*
  • *balanc*
  • *bank*
  • *Bank*Statement*
  • *budget*
  • *card*
  • *cash*
  • *compromate*
  • *confid*
  • *Confidential*Disclosure*
  • *contact*
  • *contract*
  • *Crime*
  • *crit*
  • *critical*
  • *dead*
  • *death*
  • *director*
  • *employment*
  • *Enrol*
  • *federal*
  • *federal*
  • *Finan*
  • *Forbidden*
  • *fraud*
  • *government*
  • *harassment*
  • *humiliation*
  • *identi*
  • *illegal*
  • *important*
  • *Incident*
  • *individual*
  • *injury*
  • *Insurance*
  • *intima*
  • *investigation*
  • *kill*
  • *Legal*
  • *Login*
  • *Medic*
  • *pasaporte*
  • *paspoort*
  • *pasport*
  • *passaporto*
  • *passeport*
  • *passport*
  • *password*
  • *patient*
  • *pay*
  • *payment*
  • *payroll*
  • *Personal*
  • *Private*
  • *Recruitment*
  • *Reisepass*
  • *report*
  • *Resour*
  • *Resources*Human*
  • *resurses*human*
  • *Revenue*
  • *scan*
  • *secret*
  • *security*
  • *sex*
  • *sexual*
  • *Social*Number*
  • *statement*
  • *Statement*Bank*
  • *Stealing*
  • *SWIFT*
  • *Terror*
  • *Theft*
  • *Transact*
  • *violence*
• It does not send files with the following strings:
  • *. rpt
  • *.accdb
  • *.ai
  • *.aiff
  • *.ap_
  • *.apk
  • *.application
  • *.asc
  • *.ascx
  • *.aspx
  • *.ass
  • *.au
  • *.avi
  • *.axd
  • *.bac
  • *.bak
  • *.bat
  • *.bkf
  • *.bkp
  • *.bkp
  • *.blog
  • *.bmp
  • *.bundled
  • *.c
  • *.cab
  • *.cab
  • *.cat
  • *.cch
  • *.cdf-ms
  • *.cdpresource
  • *.cdpresource
  • *.cdxml
  • *.cfm
  • *.checksum
  • *.chg
  • *.chm
  • *.chw
  • *.class
  • *.cls
  • *.cmd
  • *.config
  • *.contact
  • *.cpi
  • *.cr2
  • *.cs
  • *.cshtml
  • *.csproj
  • *.css
  • *.cvs
  • *.dat
  • *.dbf
  • *.deploy
  • *.DIC
  • *.dif
  • *.diz
  • *.dll
  • *.dotm
  • *.dtd
  • *.ed1
  • *.efi
  • *.emf
  • *.eps
  • *.epub
  • *.etl
  • *.evtx
  • *.exe
  • *.fm3
  • *.form
  • *.fp5
  • *.frm
  • *.function
  • *.function
  • *.gif
  • *.glox
  • *.gm
  • *.gz
  • *.h
  • *.hlp
  • *.hqx
  • *.hro
  • *.htm*
  • *.htm*
  • *.html
  • *.ico
  • *.idml*
  • *.IDX
  • *.indd
  • *.inf
  • *.info
  • *.ini
  • *.ipa
  • *.jar
  • *.java
  • *.jfm
  • *.js
  • *.jsm
  • *.json
  • *.jsonlz4
  • *.jsp
  • *.jss
  • *.kit*
  • *.ldf
  • *.leveldb
  • *.lnk
  • *.log
  • *.log
  • *.lua
  • *.m4a
  • *.man
  • *.manifest
  • *.map
  • *.md
  • *.md5
  • *.mdb
  • *.mid
  • *.midi
  • *.modd
  • *.mof
  • *.mov
  • *.mp3
  • *.mp3
  • *.mp4
  • *.msc
  • *.msg
  • *.msi
  • *.msm
  • *.msp
  • *.mst
  • *.mui
  • *.NEF
  • *.nib
  • *.node
  • *.nse
  • *.nupkg
  • *.nupkg
  • *.oab
  • *.obj
  • *.osxp
  • *.pbk
  • *.pdb
  • *.pfl
  • *.pfx
  • *.php
  • *.Pid
  • *.pkf
  • *.pls
  • *.potx
  • *.pp
  • *.ppt
  • *.pptx
  • *.procedure
  • *.properties
  • *.ps1
  • *.ps1xml
  • *.psd
  • *.psd1
  • *.psp
  • *.py
  • *.pyc
  • *.qm
  • *.qxd
  • *.ra
  • *.rb
  • *.rdp
  • *.resources
  • *.rll
  • *.sch
  • *.security
  • *.sit
  • *.so
  • *.soc
  • *.sqlite
  • *.su
  • *.suo
  • *.svc
  • *.swf
  • *.sys
  • *.table
  • *.tar
  • *.template
  • *.thmx
  • *.tif
  • *.tiff
  • *.tmp
  • *.tpl
  • *.trn
  • *.tt
  • *.txt
  • *.url
  • *.vb
  • *.vbs
  • *.vbs
  • *.vcf
  • *.vcf
  • *.VDI
  • *.vsdx
  • *.vsix
  • *.wav
  • *.wer
  • *.wk3
  • *.wmf
  • *.wsdl
  • *.x32
  • *.xml
  • *.xrm-ms
  • *.xsd
  • *_metadata
  • *{*
  • *}*
  • *acrodata
  • *AppData/Roaming*
  • *Boot*
  • *cache
  • *download
  • *ESET*
  • *Microsoft*
  • *Mozilla*
  • *Package Cache*
  • *Program Files*
  • *ProgramData*
  • *recicle*
  • *Recovery*
  • *Sophos*
  • *Symantec*
  • *System Volume Information*
  • *temp
  • *VMWare*
  • *Windows*