Backdoor.PS1.ASYNCRAT.N

该后门程序通过两种途径进入系统：一是被其他恶意软件作为文件释放到系统中，二是用户访问恶意网站时在不知情的情况下下载的文件。

It logs a user's keystrokes to steal information.

Arrival Details

该后门程序通过两种途径进入系统：一是被其他恶意软件作为文件释放到系统中，二是用户访问恶意网站时在不知情的情况下下载的文件。

Installation

该后门程序会释放以下文件：

• %User Temp%\Log.tmp → contains key logs

(Note: %User Temp% 是当前用户的临时文件夹,通常位于此路径 C:\Documents and Settings\{user name}\Local Settings\Temp 在Windows 2000（32位）、XP及Server 2003（32位）系统上，或 C:\Users\{user name}\AppData\Local\Temp 在Windows Vista、7、8、8.1、2008（64位）、2012（64位）及10（64位）系统上。）

它会添加以下互斥量，以确保在任何时候只有一个副本在运行：

• AsccMutexxxxxssmm1_{random}

Backdoor Routine

该后门程序会连接以下URL，接收并执行远程恶意用户下发的指令：

• {BLOCKED}.{BLOCKED}.{BLOCKED}.15
• {BLOCKED}aupload.co
• {BLOCKED}upload.co
• {BLOCKED}.{BLOCKED}.{BLOCKED}.19
• {BLOCKED}c.serveftp.net
• {BLOCKED}ic236922.serveftp.net

It connects to the following uncommon ports:

• 3322

Information Theft

该后门程序会收集以下数据：

• HWID = Hardware Identifiers
• User = Username
• OS = OS Information
• Path = Path of the malware
• Admin = If the malware is running with Admin Access
• Performance = Current Active Window
• Antivirus = Antivirus applications in the system
• If the following cryptocurrency wallet and 2FA browser extensions exist in the affected system:
  • Firefox
  • MetaMask
  • Google Chrome
  • Authenticator
  • Binance (BEW Lite)
  • BitKeep (BitGet Wallet)
  • BitPay
  • Coinbase
  • Exodus (TronLink)
  • MetaMask
  • Phantom
  • Ronin
  • Trust
  • Brave
  • Authenticator
  • MetaMask
  • Phantom
  • Edge
  • Authenticator
  • Binance
  • MetaMask
• If the following cryptocurrency applications exist in the affected system:
  • Atomic
  • Binance
  • Bitcoin
  • Coinomi
  • Electrum
  • ErgoWallet
  • Exodus
  • Ledger Live
• LastTime = Last activity time of the affected system

It logs a user's keystrokes to steal information.

其他信息

该后门程序会执行以下操作：

• It decrypts and executes an MSIL DLL loader directly in memory.
• It checks for the existence of the following files but displays a fake error regardless of whether they exist:
  • %Program Files%\AVG\Antivirus\AVGUI.exe
  • %Program Files%\Avast Software\Avast\AvastUI.exe
• It executes the following file and injects malicious code from an embedded MSIL EXE payload into the newly created process:
  • %Windows%\Microsoft.NET\Framework\{version}\{random exe file}

(Note: %Program Files% 是默认的程序安装文件夹, 通常位于此路径 C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Windows% 是Windows文件夹, 通常位于此路径 C:\Windows 适用于所有Windows操作系统版本。）