\nTrojan is a type of malware that disguises itself as clean and legitimate software and behaves totally like a useful and functional software, but when executed, it causes a lot of damage to the computer system. There are different ways in which trojans could enter the system, some are: Entering through a software downloaded from the Internet, embedding in HTML<\/em> text, attaching to an email, etc.<\/p>\n
What is the Bot.Win32.Torzhok Malware?<\/strong> \u2022 Uploading the victim’s files to the malware’s server The malware server is a public service that makes the victim’s uploaded files accessible to intruders and allows its website audience to communicate with the infected systems and send them command-line commands.<\/p>\n <\/p>\n \u274c Presence of a file named .gu1d<\/span> in the path %Temp%<\/span> Upon execution, the malware creates a GUID by invoking the Windows API CoCreateGuid<\/span> and saves it in a file named .gu1d in the %Temp% directory. This data is used as a cookie in the malware’s communications with a remote server.<\/p>\n Malware Server Address: hxxps:\/\/185[.]239[.]71[.]105<\/span> <\/p>\n <\/p>\n Table 1- Functions used by the malware to communicate with the server<\/p>\n According to the descriptions mentioned in the table above, the malware requests a task from the server after introducing its system to the server and receiving the corresponding ID associated with its host. The task received from the server can include one of the following commands (payload value):<\/p>\n \n Table 2- List of Malware Tasks Received from the Server<\/p>\n <\/p>\n While executing the received tasks and establishing the necessary communications, the malware reports the result of its task by calling the “api\/v1\/task\/”<\/em> function, then requests a new task again. Figure 1 \u2013 A Sample Task Received from the Server<\/p>\n In the figure above:<\/p>\n Overview Type: Trojan Destruction Level: High Prevalence: Low Malware names Bot.Win32.Torzhok (Padvish) Gen:Variant.Adware.Symmi.87092 (bitdefender) What is Trojan? Trojan is a type of malware that disguises itself as clean and legitimate software and behaves totally like a useful and functional software, but when executed, it causes a lot of damage to the computer system.…<\/p>\n","protected":false},"author":27,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[43,79,80],"class_list":["post-1579","post","type-post","status-publish","format-standard","hentry","category-trojan","tag-trojan","tag-torzhok","tag-bot-win32-torzhok"],"_links":{"self":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1579","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/comments?post=1579"}],"version-history":[{"count":1,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1579\/revisions"}],"predecessor-version":[{"id":1580,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1579\/revisions\/1580"}],"wp:attachment":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/media?parent=1579"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/categories?post=1579"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/tags?post=1579"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nThe Bot.Win32.Torzhok<\/em> malware operates with commands supported by a malicious bot. Notable actions of this malware include:<\/p>\n
\n\u2022 Deleting and renaming files
\n\u2022 Downloading and executing files on the victim’s system
\n\u2022 Creating a terminal on the victim’s system to execute command-line commands issued by the server<\/p>\n\nTechnical Review<\/h2>\n
Indicators of Compromise (IoCs)<\/h3>\n
\n\u274c Network connections with this the address: hxxps:\/\/185[.]239[.]71[.]105<\/span><\/p>\n\nPerformance Description<\/h3>\n
\nThe malware then communicates with its command and control server over port 443 in the observed sample. It uses REST API functions to execute its operations.<\/p>\n\n\n
\n Function<\/strong><\/td>\n Aim<\/strong><\/td>\n<\/tr>\n \n api\/v1\/greeting\/<\/em><\/strong><\/span><\/td>\n Introducing the victim’s system to the server by sending initial contact information.<\/td>\n<\/tr>\n \n api\/v1\/register\/<\/em><\/strong><\/span><\/td>\n Sending the victim’s system specifications to the server, including the full operating system details, system username, computer name, etc.<\/td>\n<\/tr>\n \n api\/v1\/heartbeat\/<\/em><\/strong><\/span><\/td>\n Receiving an identifier from the server corresponding to the victim’s host (the malware uses this identifier to receive tasks from the server).<\/td>\n<\/tr>\n \n api\/v1\/psnapshot\/<\/em><\/strong><\/span><\/td>\n Sending a list of the victim’s system processes to the server.<\/td>\n<\/tr>\n \n api\/v1\/todo\/<\/em><\/strong><\/span><\/td>\n Retrieving new tasks from the server<\/td>\n<\/tr>\n \n api\/v1\/task\/<\/em><\/strong><\/span><\/td>\n Notifying about the status of the incoming task.<\/td>\n<\/tr>\n \n api\/v1\/fetch\/<\/em><\/strong><\/span><\/td>\n Downloading files from the malware server.<\/td>\n<\/tr>\n \n api\/v1\/explorer\/<\/em><\/strong><\/span><\/td>\n Sending a list of the contents of a specific directory to the server.<\/td>\n<\/tr>\n \n api\/v1\/mq\/<\/em><\/strong><\/span><\/td>\n Receiving and executing command-line commands from the server on the victim’s system. A terminal is created on the victim’s system for this purpose, executing the received commands and sending the results back through the established pipe between the server and the infected system.<\/td>\n<\/tr>\n \n api\/v1\/files\/<\/em><\/strong><\/span><\/td>\n Uploading the contents of one or more files to the malware server.<\/td>\n<\/tr>\n \n api\/v1\/goodbye\/<\/em><\/strong><\/span><\/td>\n Terminating the connection with the server.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n \n\n
\n payload<\/strong><\/td>\n Aim<\/strong><\/td>\n<\/tr>\n \n @download<\/strong><\/em><\/span><\/td>\n Downloading one or more files from the malware server and creating them on the victim’s system by calling the api\/v1\/fetch function.<\/td>\n<\/tr>\n \n @upload<\/strong><\/em><\/span><\/td>\n Uploading one or more existing files from the victim’s system as determined by the malware server. These files are sent by calling the api\/v1\/files\/ function.<\/td>\n<\/tr>\n \n @cd<\/strong><\/em><\/span><\/td>\n Extracting a list of contents in a specified directory by calling the api\/v1\/explorer\/ function.<\/td>\n<\/tr>\n \n @psnapshot<\/strong><\/em><\/span><\/td>\n \u00a0Extracting the list of system processes by calling the api\/v1\/psnapshot\/ function.<\/td>\n<\/tr>\n \n @fetch<\/strong><\/em><\/span><\/td>\n Downloading the file<\/td>\n<\/tr>\n \n @execute<\/strong><\/em><\/span><\/td>\n Executing commands received from the server on the victim’s system.<\/td>\n<\/tr>\n \n @rm<\/strong><\/em><\/span><\/td>\n Deleting the file or files specified by the malware server from the victim’s system.<\/td>\n<\/tr>\n \n @rename<\/strong><\/em><\/span><\/td>\n Renaming one or more of the victim’s system files to the new names specified by the malware server.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\nFor example, in the received sample task presented below, in the payload content, the server has sent the @cd “C:\\\\” <\/span> command to the malware to execute. The {Qzpc}<\/em> expression in the following image is the encoded equivalent of the “C:\\\\”<\/span> directory:<\/p>\n![\"](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/06\/\u062a\u0635\u0648\u06cc\u0631-1-\u06cc\u06a9-\u0646\u0645\u0648\u0646\u0647-\u062f\u0631\u06cc\u0627\u0641\u062a-\u062a\u0633\u06a9-\u0627\u0632-\u0633\u0631\u0648\u0631.png\")
<\/p>\n\n
<\/h2>\n
How to Deal with and Clean the System<\/h2>\n
![\"\u2705\"](\"https:\/\/s.w.org\/images\/core\/emoji\/11\/svg\/2705.svg\")
Padvish Antivirus detects and removes this malware from the system. It is recommended to keep your operating system and antivirus up to date.
\nTo enhance security against the significant increase in cyberattacks, including advanced persistent threats, follow security recommendations and use Padvish Managed Detection and Response (MDR) services.<\/p>\n","protected":false},"excerpt":{"rendered":"