Trojan.Win64.HIJACKLOADER.AA

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It connects to a website to send and receive information. It does not have any backdoor routine.

It does not have any information-stealing capability.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %ProgramData%\explorewatcher_testv5\MonitorLo.exe
• %ProgramData%\explorewatcher_testv5\Thaoondklous.fjqm → encrypted payload
• %ProgramData%\explorewatcher_testv5\Quickweandbib.rfdx → encrypted payload

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)

It drops the following copies of itself into the affected system:

• %ProgramData%\explorewatcher_testv5\NonElevatedDll.dll

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)

It adds the following processes:

• %ProgramData%\explorewatcher_testv5\MonitorLo.exe

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)

It injects itself into the following processes running in the affected system's memory:

• %ProgramData%\ByteCo.exe
• %ProgramData%\XPFix.exe

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)

It creates the following folders:

• %ProgramData%\explorewatcher_testv5

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan connects to the following websites to send and receive information:

• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.134/hook/upgrade.php
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.134/check.php
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.134/hook/update_status.php?hwid={hardware ID}
• {BLOCKED}.{BLOCKED}.{BLOCKED}.89

It does not have any backdoor routine.

Rootkit Capabilities

This Trojan does not have rootkit capabilities.

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.134/ups/setup.exe
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.134/ups/ddttd.exe
• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.134/ups/svhos.exe

It connects to the following URL(s) to download its component file(s):

• https://{BLOCKED}in.com/raw/VQUKSmXR → contains {BLOCKED}.{BLOCKED}.{BLOCKED}.89
• https://{BLOCKED}in.com/raw/YwvHhwUk → contains http://{BLOCKED}.{BLOCKED}.{BLOCKED}.134

Information Theft

This Trojan gathers the following data:

• Hostname
• Public IP Address

It does not have any information-stealing capability.

Other Details

This Trojan connects to the following URL(s) to get the affected system's IP address:

• https://{BLOCKED}s.app/xml/
• http://{BLOCKED}i.com/json/?fields=11827

However, as of this writing, the said sites are inaccessible.

It does not exploit any vulnerability.