TrojanSpy.Win32.LOKI.THGBIAI

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy drops the following files:

• %Application Data%\{substring from hash of machine GUID}\{substring from hash of machine GUID}.lck
• %Application Data%\{substring from hash of machine GUID}\{substring from hash of machine GUID}.hdb

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It creates the following folders:

• %Application Data%\{substring from hash of machine GUID}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops copies of itself into folders whose names contain the following strings:

• %Application Data%\{substring from hash of machine GUID}\{substring from hash of machine GUID}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• {hash of machine GUID}

Information Theft

This Trojan Spy gathers the following data:

• User Name
• Computer Name
• Machine GUID

It attempts to steal stored account information used in the following installed File Transfer Protocol (FTP) clients or file manager software:

• 32BitFtp
• ALFTP
• BitKinex
• Bitvise SSH
• BlazeFtp
• ClassicFTP
• Cyberduck
• EasyFTP
• ExpanDrive
• Far
• Far2
• Far Manager
• FileZilla
• FlashFXP
• Fling
• FreshFTP
• FTPBox
• FTPGetter
• FTPInfo
• FTP Navigator
• FTP Now
• FTPShell
• fullsync
• DeluxeFTP
• GoFTP
• JaSFtp
• AbleFTP
• Automize
• LinasFTP
• MyFTP
• NetDrive
• NetDrive2
• Fastream NETFile
• NexusFile
• NovaFTP
• Notepad++ NppFTP
• Odin Secure FTP Expert
• PuTTY
• KiTTY
• SecureFX
• SftpNetDrive
• sherrod FTP
• SmartFTP
• Staff-FTP
• Steed
• SuperPutty
• Syncovery
• Total Commander
• UltraFXP
• WinFtp Client
• FSProtocol
• WS_FTP
• Ipswitch
• Xftp

It attempts to steal stored email credentials from the following:

• Thunderbird
• Postbox
• FossaMail
• Foxmail
• IncrediMail
• Outlook
• Pocomail
• Gmail Notifier Pro
• DeskSoft Checkmail
• Softwarenetz Mailing
• Opera Mail
• yMail2
• yMail
• TrulyMail

It attempts to get stored information such as user names, passwords, and hostnames from the following browsers:

• 360Browser
• ChromePlus
• Comodo Dragon
• Chrome
• Nichrome
• Rockmelt
• Spark
• Chromium
• Titan Browser
• Torch
• YandexBrowser
• Epic Privacy Browser
• CocCoc
• Vivaldi
• Chromodo
• Superbird
• Coowon
• Mustang Browser
• Citrio
• Chrome SxS
• Orbitum
• Iridium
• Opera
• ChromiumViewer
• Internet Explorer
• Firefox
• SeaMonkey
• Flock Browser
• K-Meleon
• IceDragon
• BlackHawk
• Cyberfox
• Pale Moon
• Lunascape6
• Waterfox
• QtWeb
• QupZilla
• Safari

Other Details

This Trojan Spy does the following:

• Gathers information from “Sticky” related applications:
  • To-Do DeskList
  • Stickies
  • NoteFly
  • Notezilla
  • Sticky Notes
• Gathers information from password managing applications:
  • Enpass Password Manager
  • My Roboform
  • 1Password
  • MikrotikWinbox

It deletes itself after execution.

Mobile Malware Routine

This Trojan Spy sends the gathered information via HTTP POST to the following URL(s):

• http://{BLOCKED}n.com/wp-includes/colors/five/fre.php