TrojanSpy.MSIL.EXMATTER.B

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy adds the following processes:

• powershell.exe -C \ "Stop-Process -Id {0}; Start-Sleep 3; Set-Content -Path '{1}' -Value 0\"", {Malware Process ID}, {Malware Filename}

Information Theft

This Trojan Spy accepts the following parameters:

• -b or -background → executes itself with its window hidden.

Other Details

This Trojan Spy does the following:

• It takes ownership of its executable folder and removes all other account’s access
• The files it sends must be from 1 year ago up to 6 years ago from its execution date
• The files it sends must be from 6 months ago up to 10 years from its execution date
• It does not send system files, temporary files, and directories
• It does not send files smaller than 4096 bytes
• It does not send files larger than 67108864 bytes
• It does not send files from the following directories:
  
  • C:\Users\All Users\Microsoft
  • C:\ProgramData
  • C:\Windows
  • C:\$Recycle.Bin
  • C:\PerfLogs
  • %Application Data%\Microsoft
  • %AppDataLocal%\Mirosoft
  • %AppDataLocal%\Packages
  • C:\Program Files
  • C:\Program Files (x86)
• It uploads files with the following extensions:
  
  • .pdf
  • .doc
  • .xls
  • .xlsx
  • .jpeg
  • .jpg
  • .txt
  • .bmp
  • .rdp
  • .txt
  • .bmp
  • .rdp
  • .sql
  • .msg
  • .pst
  • .zip
  • .rtf
  • .ipt
  • .dwg
• Creates a directory at the following URLs\address where it uploads the files:
  
  • http://{BLOCKED}.{BLOCKED}.145.18/data/ → via WebDAV
  • {BLOCKED}.{BLOCKED}.145.18:16/data/ → via SFTP
  • {FTP Address}/data → via FTP
• However, as of this writing, the said sites/addresses are inaccessible.