Trojan.JS.MANAGEX.A

This MANAGEX variant is a modular adware that is able to gather important information as a browser extension.

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain websites to send and receive information. However, as of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %AppDataLocal%\Google Chrome\Chromium\User data\Default\Extensions\{Extension Installation Directory}\images\chromium.svg
• %AppDataLocal%\Google Chrome\Chromium\User data\Default\Extensions\{Extension Installation Directory}\images\shadow.png
• %AppDataLocal%\Google Chrome\Chromium\User data\Default\Extensions\{Extension Installation Directory}\background.html
• %AppDataLocal%\Google Chrome\Chromium\User data\Default\Extensions\{Extension Installation Directory}\background.js → contains malicious script
• %AppDataLocal%\Google Chrome\Chromium\User data\Default\Extensions\{Extension Installation Directory}\config.json → contains configuration settings
• %AppDataLocal%\Google Chrome\Chromium\User data\Default\Extensions\{Extension Installation Directory}\manifest.json → contains extension details
• %AppDataLocal%\Google Chrome\Chromium\User data\Default\Extensions\{Extension Installation Directory}\test.js
• %AppDataLocal%\Google Chrome\Chromium\User data\Default\Extensions\{Extension Installation Directory}\tr.js

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Information Theft

This Trojan gathers the following data:

• OS Version
• Chrome Details
  • ID
  • Version
  • Language
  • Browser Flavor
• Location
  • Country
  • IP Address
• Date and Time

Other Details

This Trojan connects to the following website to send and receive information:

• http://taw{BLOCKED}.com/update
• http://geo.s{BLOCKED}.com/details
• http://{BLOCKED}.ly/2ry7vC5 → contains privacy policy
• http://cun{BLOCKED}.com
• http://cab{BLOCKED}.com
• https://tr{BLOCKED}.go{BLOCKED}.com/trends/hottrends/hotItems
• d34{BLOCKED}.cloudfront.net

It does the following:

• This Chrome extension monitors the browsing activities of a user including all tabs and windows created, whether minimized or maximized, and all the clicks that registered in the Chrome extension widget.
• It is capable of injecting a script (advia.chopsticks.js).
• It sets permission to allow access to the following Chrome APIs:
  • Management
  • Background
  • Storage
  • Cookies
  • Tabs
  • webRequest
  • webRequestBlocking
  • unlimitedStorage
  • contextMenus
  • bookmarks
  • webNavigation
  • history
  • topSites
  • activeTab
  • alarms
  • browsingData
  • clipboardRead
  • clipboardWrite
  • contentSettings
  • debugger
  • declarativeContent
  • desktopCapture
  • downloads
  • gcm
  • geolocation
  • identity
  • idle
  • nativeMessaging
  • notifications
  • pageCapture
  • power
  • printerProvider
  • privacy
  • proxy
  • sessions
  • system.cpu
  • system.display
  • system.memory
  • system.storage
  • tabCapture
  These access permissions are allowed to all sites/URLs visited

However, as of this writing, the said sites are inaccessible.