TrojanSpy.BAT.VIPKEYLOGGER.A

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy drops the following copies of itself into the affected system:

• %User Profile%\aoc.bat

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Propagation

This Trojan Spy does not have any propagation routine.

Backdoor Routine

This Trojan Spy does not have any backdoor routine.

Rootkit Capabilities

This Trojan Spy does not have rootkit capabilities.

Process Termination

This Trojan Spy terminates the following processes if found running in the affected system's memory:

• chrome
• firefox
• msedge
• brave
• Foxmail

Information Theft

This Trojan Spy gathers the following data:

• Public IP Address
• Geolocation
• Hostname
• Username
• Current Date and Time
• Email Address
• Email Password
• Cookies
• Credit Card Information
• Autofill Passwords
• Browser History
• Browser Downloads
• Clipboard Data
• Keystrokes

Stolen Information

This Trojan Spy sends the gathered information via HTTP POST to the following URL:

• http://v{BLOCKED}.com:8081
• http://a{BLOCKED}s.org:8081
• http://an{BLOCKED}my:8081
• https://api.t{BLOCKED}t/sendMessage?chat_id={chat id}&text={stolen information}

Other Details

This Trojan Spy connects to the following URL(s) to get the affected system's IP address:

• http://c{BLOCKED}.org/

It does the following:

• It patches the Antimalware Scan Interface (AMSI) to disable security features of the affected system.
• It patches Event Tracing for Windows (ETW) to disable event logging of the affected system.
• It loads the following file in the memory:
  • Aubriella.exe → VIPKeylogger Payload
• It connects to the following URL to get the affected system's geolocation:
  • https://r{BLOCKED}.org/xml/{public ip address of system}
• It steals information from the following web browsers:
  • Google Chrome
  • CocCoc
  • Tencent QQ Browser
  • Orbitum
  • Amigo
  • Xpom
  • Kometa
  • Nichrome
  • Slimjet
  • Iridium
  • Vivaldi
  • Chromium
  • GhostBrowser
  • CentBrowser
  • Xvast
  • Chedot
  • SuperBird
  • 360Browser
  • 360Chrome
  • Comodo
  • Brave
  • Torch Browser
  • UCBrowser
  • Blisk
  • Epic Privacy Browser
  • AVAST Software
  • Kinza
  • BlackHawk
  • Citrio
  • Uran
  • Coowon
  • 7Star
  • QIP Surf
  • ChromePlus
  • Sputnik
  • Microsoft Edge
  • Opera
  • Liebao7
  • SlimBrowser
  • Mozilla Firefox
  • Mozilla SeaMonkey
• It steals information from the following email applications:
  • Outlook
  • Foxmail
  • Thunderbird
  • PostBoxApp
• It checks if the gathered information contains the following strings:
  • 8{BLOCKED}0
  • 6{BLOCKED}9
  • 1{BLOCKED}1
  • 6{BLOCKED}9
  • 3.{BLOCKED}7
  • WALKER

NOTES:

It does not exploit any vulnerability.