TrojanSpy.Win32.FORMBOOK.SHKI

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

It terminates itself if it detects it is being run in a virtual environment.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy adds the following folders:

• %Application Data%\InsoftaDevelopment\SmartCoverTuner
• %Application Data%\{Random characters} (contains stolen information)
• %Program Files%\{Random characters}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops the following files:

• %Application Data%\InsoftaDevelopment\SmartCoverTuner\GuideStyles.txt
• %Application Data%\InsoftaDevelopment\SmartCoverTuner\Installation.ini
• %Application Data%\InsoftaDevelopment\SmartCoverTuner\OpenTK.GLControl.dll
• %Application Data%\InsoftaDevelopment\SmartCoverTuner\ProgDvbNet.Win.dll
• %Application Data%\InsoftaDevelopment\SmartCoverTuner\Xamarin.Forms.Platform.dll
• %Application Data%\InsoftaDevelopment\SmartCoverTuner\install.log
• %Application Data%\InsoftaDevelopment\SmartCoverTuner\libsm51.dll
• %Application Data%\InsoftaDevelopment\SmartCoverTuner\smartTuner.exe
• %Application Data%\InsoftaDevelopment\SmartCoverTuner\usage.pdf
• %Application Data%\InsoftaDevelopment\SmartCoverTuner\Transponders\All.list
• %Application Data%\InsoftaDevelopment\SmartCoverTuner\Transponders\ATSC\list.txt
• %Application Data%\InsoftaDevelopment\SmartCoverTuner\Transponders\CabFiles\all.list
• %Application Data%\InsoftaDevelopment\SmartCoverTuner\Transponders\CabFiles\userlist.txt
• %Application Data%\InsoftaDevelopment\SmartCoverTuner\Transponders\IPTV\Rostelecom.m3u
• %Application Data%\InsoftaDevelopment\SmartCoverTuner\Transponders\TerFiles\all.list
• %Application Data%\InsoftaDevelopment\SmartCoverTuner\Transponders\TerFiles\userlist.txt
• %Program Files%\{Random characters}\{Random characters}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• %Application Data%\InsoftaDevelopment\SmartCoverTuner\smartTuner.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It injects codes into the following process(es):

• audiodg.exe
• autochk.exe
• autoconv.exe
• autofmt.exe
• chkdsk.exe
• cmd.exe
• cmmon32.exe
• cmstp.exe
• colorcpl.exe
• control.exe
• cscript.exe
• dwm.exe
• explorer.exe
• help.exe
• ipconfig.exe
• lsass.exe
• lsm.exe
• msdt.exe
• msg.exe
• msiexec.exe
• mstsc.exe
• napstat.exe
• nbtstat.exe
• netsh.exe
• netstat.exe
• raserver.exe
• rdpclip.exe
• rundll32.exe
• services.exe
• spoolsv.exe
• systray.exe
• svchost.exe
• taskhost.exe
• wwahost.exe
• wininit.exe
• wlanext.exe
• wscript.exe
• wuapp.exe
• wuauclt.exe

Autostart Technique

This Trojan Spy adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{Random characters} = {Malicious dropped payload}

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run
{Random characters} = {Malicious dropped payload}

Propagation

This Trojan Spy does not have any propagation routine.

Backdoor Routine

This Trojan Spy executes the following commands from a remote malicious user:

• Download and execute file
• Uninstall or update self
• Execute arbitrary commands
• Delete files
• Power off or reboot machine
• Install persistence
• Send information

It connects to the following websites to send and receive information:

• http://www.{BLOCKED}rchids.com/vns                  
• http://www.{BLOCKED}eatsgamingclan.com/vns          
• http://www.{BLOCKED}688.com/vns                      
• http://www.{BLOCKED}icamackay.com/vns                
• http://www.{BLOCKED}sbroider.com/vns                
• http://www.{BLOCKED}oft.com/vns                      
• http://www.{BLOCKED}ndigarh.com/vns                  
• http://www.{BLOCKED}tmheduaction.com/vns            
• http://www.{BLOCKED}lpardis.com/vns                  
• http://www.{BLOCKED}yarendi44.net/vns                
• http://www.{BLOCKED}art.net/vns                      
• http://www.{BLOCKED}ayresidency.com/vns              
• http://www.{BLOCKED}ioamadori.net/vns                
• http://www.{BLOCKED}edshop2020.com/vns              
• http://www.{BLOCKED}ht.com/vns                      
• http://www.{BLOCKED}dhousedesigns.design/vns        
• http://www.{BLOCKED}njiajiao.com/vns                
• http://www.{BLOCKED}ardenhealing.space/vns          
• http://www.{BLOCKED}portal.com/vns                  
• http://www.{BLOCKED}egopalacio.com/vns              
• http://www.{BLOCKED}p.com/vns                        
• http://www.{BLOCKED}eint.com/vns                    
• http://www.{BLOCKED}i.site/vns                      
• http://www.{BLOCKED}rz.com/vns                      
• http://www.{BLOCKED}een.com/vns                      
• http://www.{BLOCKED}wnfitnesstulsa.com/vns          
• http://www.{BLOCKED}oaria.com/vns                    
• http://www.{BLOCKED}llche.com/vns                    
• http://www.{BLOCKED}rader.com/vns                    
• http://www.{BLOCKED}rrapate.com/vns                  
• http://www.{BLOCKED}sresolve.com/vns                
• http://www.{BLOCKED}tpetproducts.com/vns            
• http://www.{BLOCKED}ds.com/vns                      
• http://www.{BLOCKED}d-78613.com/vns                  
• http://www.{BLOCKED}rtners378.com/vns                
• http://www.{BLOCKED}n.com/vns                        
• http://www.{BLOCKED}en.com/vns                      
• http://www.{BLOCKED}assetmanagement.com/vns          
• http://www.{BLOCKED}ssentialmiss.com/vns            
• http://www.{BLOCKED}latinumva.com/vns                
• http://www.{BLOCKED}isc.com/vns                      
• http://www.{BLOCKED}furnituremadera.com/vns          
• http://www.{BLOCKED}scollectionn.com/vns            
• http://www.{BLOCKED}rofessionalpodcast.com/vns      
• http://www.{BLOCKED}etesproduce.com/vns              
• http://www.{BLOCKED}cia.com/vns                      
• http://www.{BLOCKED}erbsindia.com/vns                
• http://www.{BLOCKED}ding.net/vns                    
• http://www.{BLOCKED}do.com/vns                      
• http://www.{BLOCKED}tor.com/vns                      
• http://www.{BLOCKED}ing.com/vns                      
• http://www.{BLOCKED}sshours.com/vns                  
• http://www.{BLOCKED}rsotocheckup-5fcc.com/vns        
• http://www.{BLOCKED}clnicadelvnculo-gvbi.com/vns    
• http://www.{BLOCKED}ihindi.com/vns                  
• http://www.{BLOCKED}ence.com/vns                    

Rootkit Capabilities

This Trojan Spy does not have rootkit capabilities.

Information Theft

Upon execution of the affected application, it gathers the following information:

• SID
• Username
• Operating system
• Screen captures
• Clipboard and keylogged data from injected applications

Other Details

This Trojan Spy terminates itself if it detects it is being run in a virtual environment.

It does the following:

• It injects itself to these targeted applications to steal information:
  • alftp.exe
  • avant.exe
  • barca.exe
  • blackhawk.exe
  • chrome.exe
  • classicftp.exe
  • coreftp.exe
  • cyberfox.exe
  • dragon.exe
  • epic.exe
  • explorer.exe
  • far.exe
  • filezilla.exe
  • firefox.exe
  • flashfxp.exe
  • fling.exe
  • foxmail.exe
  • ftpvoyager.exe
  • gmailnotifierpro.exe
  • icedragon.exe
  • icq.exe
  • iexplore.exe
  • incmail.exe
  • kmeleon.exe
  • luna.exe
  • maxthon.exe
  • microsoftedgecp.exe
  • midori.exe
  • notepad.exe
  • opera.exe
  • operamail.exe
  • outlook.exe
  • palemoon.exe
  • pidgin.exe
  • poco.exe
  • qtweb.exe
  • qupzilla.exe
  • safari.exe
  • seamonkey.exe
  • skype.exe
  • thunderbird.exe
  • torch.exe
  • trillian.exe
  • ucbrowser.exe
  • vivaldi.exe
  • waterfox.exe
  • whatsapp.exe
  • winscp.exe
  • yahoomessenger.exe

NOTES:

It does not proceed to its malicious routine if it detects that it is being debugged.

It does not exploit any vulnerability.