HACKTOOL.VBS.RAVEN.GB

This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be manually installed by a user.

Arrival Details

This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be manually installed by a user.

Installation

This Hacking Tool drops the following files depending on the platform/operating system of the affected computer:

• %System%\norm{random 5 characters}.nls - contains login log and other error results
• %System%\perf{random 2 characters}{random 3 digits}.dat - stores result
• %User Temp%\~{random 18 characters}.TMP - contains logs of localcommand

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

Download Routine

This Hacking Tool saves the files it downloads using the following names:

• %System%\{random 16 characters}

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Information Theft

This Hacking Tool accepts the following parameters:

• /cmd - single commmand mode
• /shell -half-interactive shell mode
• host = computername or sharename or decvicename or IP address
• pass = password
• user = domainname or username
• persist = and executes specified command without saving to %System%\perf{random 2 characters}{random 3 digits}.dat and executes in background
• saveresult = executes specified command and saves result to %System%\perf{random 2 characters}{random 3 digits}.dat
• wait =displays wait time
• share = creates shared folder
• command = can be any of the following and works in /shell mode
  • localcommand -> run command in local and saves result to %User Temp%\~{random 18 characters}.TMP
  • put -> upload file and saves to shared resource specified in the connected resource and saves as {host}\{Shared folder }\{random 16 characters}
  • get ->download file from {host}\{Shared folder}\{file specified} to %System%\{random 16 characters}
  • exit -> exits the program

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

Other Details

This Hacking Tool does the following:

• Has the capability to change directory.
• Deletes net use entries.
• Has the ability to create processes.
• Capability to download and upload from specified host.
• Has the capability to create a network share inside the specified host.
• Has the ability to execute commands locally or inside the specified host.
• Connect to other host using "net use" (used to connect and configure connections to shared resources).