TrojanSpy.Win64.DIRECTKEYLOGGER.A

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be dropped by other malware.

It logs a user's keystrokes to steal information.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be dropped by the following malware:

• Trojan.Win64.DIRECTKEYLOGGER.AA

Installation

This Trojan Spy adds the following folders:

• %Public%\Microsoft
• %Public%\Microsoft\System
• %Public%\Microsoft\System\Update

(Note: %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\{Random Characters}
• Global\run_{explorer.exe PID}

It injects codes into the following process(es):

• explorer.exe

Information Theft

This Trojan Spy gathers the following data:

• Computer Name
• Username
• Running processes
• Keystrokes under running processes
• Clipboard data

It logs a user's keystrokes to steal information.

Stolen Information

This Trojan Spy saves the stolen information in the following file:

• %Public%\Microsoft\System\Update\update-{YYYY}-{MM}-{DD}-{HH}-{MM}-{ss}.log

(Note: %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.)

Other Details

This Trojan Spy does the following:

• It may be registered and executed as a service by the following:
  • Trojan.BAT.STARTER.UWAOOABQ
• It requires to be ran as a service to continue with its malicious routine