Backdoor.MSIL.LXRAT.A

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor drops the following files:

• %AppDataLocal%\WindowsTelemetry\installed.dat → installation marker
• msasn1.dll → for browser credential decryption
• chrome_decrypt.dll → for browser credential decryption
• ChromePayload.dll → for browser credential decryption
• payload.dll → for browser credential decryption

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It creates the following folders:

• %AppDataLocal%\WindowsTelemetry\Logs

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\bab27c3495a940d8a72f17485939f626

Other System Modifications

This Backdoor adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\CapabilityAccessManager\
ConsentStore\microphone
microphone = "Deny"

Propagation

This Backdoor does not have any propagation routine.

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• RemoteShell → Opens a remote command shell (cmd or powershell)
• FileManager → Uploads, downloads, searches, and manages files on the affected system
• RemoteDesktop → Captures the desktop and allows remote mouse and keyboard control
• RemoteWebcam → Captures video from the webcam
• RemoteMicrophone → Captures audio from the microphone
• RemoteSound → Captures system audio output
• HVNC → Opens a hidden virtual desktop with Discord and Chrome browser cloning
• Keylogger → Records keystrokes organized by foreground window
• AutoCliptro → Monitors and replaces clipboard content (clipbanker)
• DataRecoveryRequest → Steals browser credentials, cookies, Discord tokens, Telegram sessions, crypto wallets, and mail client credentials
• SystemInfo → Collects system information via WMI
• ProcessList → Enumerates running processes with start and kill capabilities
• TCPConnections → Lists and terminates active TCP connections
• ReverseProxy → Establishes a reverse proxy tunnel through the affected system
• RegistryManager → Reads registry keys and values
• StartupManager → Adds, removes, and lists startup items
• Update → Replaces the running payload with a new version
• DownloadAndExecute → Downloads and executes a file from a specified URL
• Uninstall → Removes the backdoor from the affected system
• RequestElevation → Requests elevated privileges
• Shutdown → Shuts down the affected system
• Restart → Restarts the affected system
• Standby → Puts the affected system into standby mode
• ScreenCapture → Captures screenshots of the desktop
• HvncPluginUpload → Uploads a plugin DLL for the hidden virtual desktop
• PayloadStubUpload → Uploads additional payload components from the C2 server

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• neuvop.{BLOCKED}s.eu:62051

Rootkit Capabilities

This Backdoor does not have rootkit capabilities.

Information Theft

This Backdoor gathers the following data:

• User name
• Machine name
• Operating system build information
• GeoIP information (country, city, ISP, country code)
• Backdoor version and campaign group identifier
• Keystrokes organized by foreground window
• Clipboard content
• Screenshots
• Webcam video
• Microphone audio
• System audio
• Credentials and data (cookies, autofill data, and credit card information) from the following browsers:
  • Google Chrome
  • Microsoft Edge
  • Brave
  • Opera
  • Opera GX
  • Yandex
  • Vivaldi
  • Chromium
  • SRWare Iron
  • Sogou
  • Mozilla Firefox (logins.json, places.sqlite)
• Tokens from the following applications:
  • Discord
  • Discord Canary
  • Discord PTB
  • Discord Development
• Session data from the following application:
  • Telegram Desktop (tdata directory)
• Data from the cryptocurrency wallets through:
  • wallet.dat files
  • Wallet browser extensions
• Credentials from mail clients such as:
  • POP3 host/port
  • IMAP host/port
  • SMTP host/port
  • password information

Other Details

This Backdoor connects to the following possibly malicious URL:

• http://{BLOCKED}i.com/json/ → GeoIP reconnaissance

It does the following:

• Injects code into CasPol.exe via process hollowing to execute its payload within a legitimate Windows process
• Operates a hidden virtual desktop (HVNC) capable of cloning Discord and Chrome browser sessions
• Establishes a reverse proxy tunnel through the affected system
• Monitors the clipboard and replaces cryptocurrency wallet addresses (clipbanker)
• Disables microphone access consent via registry modification
• Enumerates scheduled tasks on the affected system
• Avoids the following directories during file enumeration:
  • $recycle.bin
  • system volume information
  • winsxs
  • $windows.~bt
  • $windows.~ws
  • windows.old
  • softwaredistribution
  • catroot2
• Avoids file with the following extensions during file enumeration:
  • .exe
  • .dll
  • .pdb
  • .obj
  • .lib
  • .bin
  • .sys
  • .dat
  • .zip
  • .rar
  • .7z
  • .gz
  • .tar
  • .bz2
  • .xz
  • .cab
  • .msi
  • .png
  • .jpg
  • .jpeg
  • .gif
  • .bmp
  • .ico
  • .tiff
  • .webp
  • .mp3
  • .mp4
  • .avi
  • .mkv
  • .mov
  • .wav
  • .flac
  • .ogg
  • .pdf
  • .doc
  • .docx
  • .xls
  • .xlsx
  • .ppt
  • .pptx
  • .db
  • .sqlite
  • .mdb
  • .accdb
  • .ldb
  • .ldf
  • .mdf
  • .iso
  • .img
  • .vmdk
  • .vhd
  • .apk
  • .jar
  • .class
  • .ttf
  • .otf
  • .woff
  • .woff2
• It bypasses Chrome App-Bound Encryption to decrypt protected browser credentials by injecting a decryption DLL into a spawned browser process via a COM elevation service.

It accepts the following parameters:

• --internal-telemetry → Runs the browser App-Bound Encryption decryptor stage

It does not exploit any vulnerability.