Trojan.VBS.POWLOAD.I

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following processes:

• `"%System%\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand {base64-encoded equivalent of the obfuscated PowerShell command}`
• `"%System%\wbem\WMIC.exe" /Node:localhost /Namespace:\root\cimv2 path Win32_Process call Create`
• `"%System%\getmac.exe"` → retrieves the MAC or physical address of the machine
• `"%System%\schtasks.exe" /create /TN Chrome_Update /TR "%System%\wscript.exe /b ""%Public%\Music\bot.vbe""" /SC MINUTE /mo 15 /f`→ creates a scheduled task

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.)

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

Rootkit Capabilities

This Trojan does not have rootkit capabilities.

Information Theft

This Trojan gathers the following data:

• Media Access Control (MAC) address of the affected system's network interface

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}.{BLOCKED}.148.84//support.php?type=apple&seed={MAC Address} → contains an `schtasks.exe` command string that installs the persistence scheduled task described in the Installation section. Note that the command string can be modified anytime by the malicious actor.

It does the following:

• Creates a `Win32_ProcessStartup` instance and sets its `ShowWindow` property to `12` (SW_HIDE) so that the spawned PowerShell window is invisible to the user
• Uses the PowerShell `Net.WebClient.DownloadString` method to retrieve the second-stage string command from the C2 server
• Executes the downloaded command in memory through the `Invoke-Expression` (`iex`) cmdlet without writing it to disk

It does not exploit any vulnerability.

It adds the following scheduled tasks:

• Task name: `\Chrome_Update`
  Trigger: every 15 minutes
  Action: `%System%\wscript.exe /b C:\Users\Public\Music\bot.vbe`

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)