Analysis by: Khristian Joseph Morales
ALIASES:

Trojan:PowerShell/BynocoLNK.BEOE!MTB (MICROSOFT)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

Tamaño del archivo 2,638 bytes
Tipo de archivo LNK
Residente en memoria No
Fecha de recepción de las muestras iniciales 19 May 2022

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following folders:

  • %AppDataLocal%\BEhFcGmnp

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

  • "%System%\cmd.exe" /v:on /c {encoded base 64}||goto&p^o^w^e^r^s^h^e^l^l.e^x^e -c "&{$kRMaFO='{encoded base 64}';$hLTAQy='{encoded base 64}';$RY=[System.Convert]::FromBase64String($kRMaFO+$hLTAQy);$vZ=[System.Text.Encoding]::ASCII.GetString($RY); iex ($vZ)}"
  • powershell.exe -c "&{$kRMaFO='{encoded base 64}';$hLTAQy='{encoded base 64}';$RY=[System.Convert]::FromBase64String($kRMaFO+$hLTAQy);$vZ=[System.Text.Encoding]::ASCII.GetString($RY); iex ($vZ)}"
  • "%System%\regsvr32.exe" %User Temp%\..\BEhFcGmnp\IfcziNlbBL.EnA

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Download Routine

This Trojan saves the files it downloads using the following names:

  • %AppDataLocal%\BEhFcGmnp\IfcziNlbBL.EnA

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other Details

This Trojan connects to the following possibly malicious URL:

  • http://{BLOCKED}-shoshi.main.jp/yamada-shoshi/lg1/
  • http://{BLOCKED}ign.nl/libraries/c8NvFU14/
  • https://{BLOCKED}ation-esisa.fr/css/iU2SYlfYxsk/
  • http://{BLOCKED}g.uz/Docs/1kj8refeLdotQee2f/
  • http://{BLOCKED}imarlik.com.tr/wp-admin/9IW7L1gKwWOoNQREJ6/
  • http://{BLOCKED}lustphtravel.com/cgi-bin/QphfoQq4t/