TrojanSpy.MSIL.REDENERGY.THJAOBD

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It adds certain registry entries to disable the Task Manager. This action prevents users from terminating the malware process, which can usually be done via the Task Manager.

It encrypts files with specific file extensions. It drops files as ransom note.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy drops the following files:

• %User Temp%\{9 random alphanumeric}.jpg → desktop wallpaper after encryption
• %User Temp%\tmp{4 random alphanumeri}c.tmp.bat → terminates and deletes executed malware after encryption routine; deleted afterwards

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• vssadmin delete shadows /all /quiet & wmic shadowcopy delete
• bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
• wbadmin delete catalog -quiet
• chcp 65001
• taskkill /F /IM {pid of malware}
• timeout /T 10 /Nobreak
• Del /a /f / q {malware full path}
• Del /a /f / q {malware execution path}\DotNetZip.dll
• Del /a /f / q {malware execution path}\Newtonsoft.Json.dll

Other System Modifications

This Trojan Spy adds the following registry entries to disable the Task Manager:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = 1

It sets the system's desktop wallpaper to the following image:

Process Termination

This Trojan Spy terminates the following services if found on the affected system:

• BackupExecAgentBrowser
• BackupExecDiveciMediaService
• BackupExecJobEngine
• BackupExecManagementService
• vss
• sql
• svc$
• memtas
• sophos
• veeam
• backup
• GxVss
• GxBlr
• GxFWD
• GxCVD
• GxCIMgr
• DefWatch
• ccEvtMgr
• SavRoam
• RTVscan
• QBFCService
• Intuit.QuickBooks.FCS
• YooBackup
• YooIT
• zhudongfangyu
• sophos
• stc_raw_agent
• VSNAPVSS
• QBCFMonitorService
• VeeamTransportSvc
• VeeamDeploymentService
• VeeamNFSSvc
• veeam
• PDVFSService
• BackupExecVSSProvider
• BackupExecAgentAccelerator
• BackupExecRPCService
• AcrSch2Svc
• AcronisAgent
• CASAD2DWebSvc
• CAARCUpdateSvc
• TeamViewer

Information Theft

This Trojan Spy gathers the following data:

• Username
• Hostname
• Battery Life
• Clipboard Data
• List of Installed Applications
• OS Version
• OS Product Key
• List of Installed AV Products

Other Details

This Trojan Spy does the following:

• It sets its own file attributes to SYSTEM and HIDDEN.
• It can disable the task manager.
• It terminates and deletes itself after its encryption routine.
• It loads vaultcli.dll and calls its functions to retrieve all saved data from the following browsers:
  • Opera Software
  • Edge
  • Firefox
  • Internet explorer
• It steals information from the following VPN services:
  • NordVPN
  • OpenVPN
  • ProtonVPN
• It steals information from the following email clients:
  • DeskSoft
  • Foxmail
  • GetyMail2
  • Opera_Mail
  • Outlook
  • Pocomail
  • TrulyMail
  • yMail
  • yMail2
• It steals information from the following gaming platforms installed:
  • BattleNET
  • Steam
  • Uplay
• It steals information from the following password managers:
  • Enpass
  • KeePass
  • mSecure
  • NordPass
  • _Password
  • Wallets
• It steals information from the following file transfer tools:
  • AbleFTP14
  • BlazeFtp
  • Cyberduck
  • DeluxeFTP
  • Estsoft
  • Far
  • FTPBox
  • FTPGetter
  • FTP_Now
  • FTPShell
  • GetAutomize14
  • GetFileZilla
  • GoFTP
  • INSoftware
  • iterate_GmbH
  • JaSFtp14
  • NetDrive2
  • NexusFile
  • Odin_Secure_FTP_Expert
  • SftpNetDrive
  • Staff_FTP
  • UltraFXP
  • WS_FTP
• It steals information from the following messaging platforms:
  • Discord
  • GetPaltalk
  • QQ
  • SignalGetJSON
  • SignalGetSQL
  • Skype
  • Telegram
  • TOX
  • Viber
  • Vime
  • WickrMe
  • Wickr_Pro
  • Pidgin
• It steals information from the following system/file management tools:
  • ExpanDrive
  • GetTotalCommander
  • Ipswitch
  • SuperPutty
  • Syncovery
• It steals the following browser information:
  • Web Data
  • Login Data
  • Cookies
  • History
  • History
  • Web Data
  • Bookmarks
  • CreditCards.txt
  • Passwords.txt
  • Cookies.txt
  • History.txt
  • Downloads.txt
  • AutoFill.txt
  • Bookmarks.txt

Ransomware Routine

This Trojan Spy encrypts files with the following extensions:

• pdf
• rtf
• doc
• docx
• xls
• xlsx
• ppt
• pptx
• odt
• indd
• txt
• json
• torrent
• rdp
• vn
• contact
• dat
• db3
• db4
• kdb
• kdbx
• sql
• sqlite
• mdb
• dsk
• dbf
• walle
• vb
• c
• cs
• cpp
• asm
• sh
• py
• pyw
• html
• css
• php
• go
• js
• rb
• pl
• swift
• java
• kt
• kts
• ino
• mafil
• jpg
• jpeg
• png
• bm
• tar
• Z
• ace
• pea
• sfx
• AR

It avoids encrypting files with the following strings in their file name:

• boot.ini
• bootfont.bin
• boot.ini
• iconcache.db
• ntuser.dat
• ntuser.dat.log
• ntuser.ini
• thumbs.db
• autorun.inf
• bootsect.bak
• bootmgfw.efi
• desktop.ini

It avoids encrypting files with the following strings in their file path:

• appdata\local
• appdata\locallow
• users\all users
• \ProgramData

It avoids encrypting files found in the following folders:

• Program Files
• Program Files (x86)
• Windows
• $Recycle.Bin
• MSOCache
• Documents and Settings
• Intel
• PerfLogs
• Windows.old
• AMD
• NVIDIA
• ProgramData

It appends the following extension to the file name of the encrypted files:

• {original filename}.{original extension}.{4 random alphanumeric}

It drops the following file(s) as ransom note:

• {encrypted directory}\read_it.txt