TrojanSpy.Win32.VIDAR.CFI

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Elimina archivos para impedir la ejecución correcta de programas y aplicaciones.

Recopila determinada información del equipo afectado.

Se conecta a determinados sitios Web para enviar y recibir información.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• where gathered information is archived before exfiltrated:
  • %ProgramData%\{Random numbers}\_{Random numbers}.zip
• where gathered information is stored:
  • %ProgramData%\{Random numbers}\outlook.txt → Deleted Afterwards
  • %ProgramData%\{Random numbers}\passwords.txt → Deleted Afterwards
  • %ProgramData%\{Random numbers}\screenshot.jpg → Deleted Afterwards
  • %ProgramData%\{Random numbers}\system.txt → Deleted Afterwards
  • %ProgramData%\{Random numbers}\temp → Deleted Afterwards
  • %ProgramData%\{Random numbers}\autofill\{stolen information} → Deleted Afterwards
  • %ProgramData%\{Random numbers}\cc\{stolen information} → Deleted Afterwards
  • %ProgramData%\{Random numbers}\cookies\{stolen information} → Deleted Afterwards
  • %ProgramData%\{Random numbers}\crypto\{Cryptocurrency name}\{stolen wallet information} → Deleted Afterwards

Agrega los procesos siguientes:

• "%System%\rundll32.exe" "%System%\wininet.dll", DispatchAPIcall 1

(Nota: %System% es la carpeta del sistema de Windows, que en el caso de Windows 98 y ME suele estar en C:\Windows\System, en el caso de Windows NT y 2000 en C:\WINNT\System32 y en el caso de Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) y 10(64-bit) en C:\Windows\System32).

Crea las carpetas siguientes:

• where stolen information is stored:
  • %ProgramData%\{random numbers} → Deleted after exfiltration
  • %ProgramData%\{random numbers}\autofill → Deleted after exfiltration
  • %ProgramData%\{random numbers}\cc → Deleted after exfiltration
  • %ProgramData%\{random numbers}\cookies → Deleted after exfiltration
  • %ProgramData%\{random numbers}\crypto → Deleted after exfiltration

Otras modificaciones del sistema

Elimina los archivos siguientes:

• %ProgramData%\freebl3.dll
• %ProgramData%\mozglue.dll
• %ProgramData%\msvcp140.dll
• %ProgramData%\nss3.dll
• %ProgramData%\softokn3.dll
• %ProgramData%\sqlite3.dll
• %ProgramData%\vcruntime140.dll

Finalización del proceso

Finaliza los procesos siguientes relacionados con malware:

• /c taskkill /pid {Process ID} & erase {MalwarePath}\{Malware Name} & RD /S /Q %ProgramData%\{Random numbers}\* & exit

Robo de información

Recopila la siguiente información del equipo afectado:

• Browser data (e.g. cookies, credentials, autofills, credit card data)
  • Google Chrome
  • Chromium
  • Kometa
  • Amigo
  • Torch
  • Orbitum
  • Comodo Dragon
  • Nichrome
  • Maxthon5
  • Sputnik
  • EPB
  • Vivaldi
  • CocCoc Browser
  • Uran Browser
  • QIP Surf
  • Cent
  • Elements Browser
  • TorBro
  • Microsoft Edge
  • CryptoTab
  • Brave
  • Opera
  • Mozilla Firefox
  • Pale Moon
  • Waterfox
  • Cyberfox
  • BlackHawk
  • IceCat
  • KMeleon
  • Thunderbird
• Email credentials:
  • Outlook
• Cryptocurrency Wallet data
  • Anoncoin
  • BBQCoin
  • Bitcoin
  • DashCore
  • devcoin
  • digitalcoin
  • ElectronCash
  • Electrum
  • Electrum-LTC
  • Ethereum
  • Exodus
  • Florincoin
  • Franko
  • Freicoin
  • GoldCoinGLD
  • Infinitecoin
  • IOCoin
  • Ixcoin
  • jaxx
  • Litecoin
  • Megacoin
  • Mincoin
  • MultiDoge
  • Namecoin
  • Primecoin
  • Terracoin
  • YACoin
  • Zcash
• System Information
  • OS Version and Architecture
  • Username
  • Computer name
  • System Language
  • Machine ID
  • GUID
  • Domain Name
  • Workgroup
  • Keyboard Languages
• Hardware Information
  • Processor
  • # of Logical Processors
  • Videocard
  • Display resolution
  • RAM
  • If laptop or desktop
• Local time & zone
• Network Information
  • IP Address
  • Country
• Installed software & version
• Screenshot of user's desktop

Otros detalles

Se conecta al sitio Web siguiente para enviar y recibir información:

• http://{BLOCKED}3g7u3EO07WT42n7f4vIn5fZH.biz

Hace lo siguiente:

• It terminates itself if any of the user default language identifiers is found:
  • Kazakh (Kazakhstan)
  • Russian (Russia)
  • Ukrainian (Ukraine)
  • Belarusian (Belarus)
  • Uzbek - Latin (Uzbekistan)
  • Azeri - Cyrillic (Azerbaijan)