TrojanSpy.MSIL.REDENERGY.THJAOBD

该木马间谍程序通过两种途径进入系统：一是被其他恶意软件作为文件释放到系统中，二是用户访问恶意网站时在不知情的情况下下载的文件。

该恶意程序通过添加特定注册表项来禁用任务管理器。 这一操作会阻止用户通过任务管理器终止恶意软件进程——这通常是终止此类进程的常规方式。

它会对特定扩展名的文件进行加密。 它会释放作为勒索信的文件。

Arrival Details

该木马间谍程序通过两种途径进入系统：一是被其他恶意软件作为文件释放到系统中，二是用户访问恶意网站时在不知情的情况下下载的文件。

Installation

该间谍木马会释放以下文件：

• %User Temp%\{9 random alphanumeric}.jpg → desktop wallpaper after encryption
• %User Temp%\tmp{4 random alphanumeri}c.tmp.bat → terminates and deletes executed malware after encryption routine; deleted afterwards

(Note: %User Temp% 是当前用户的临时文件夹,通常位于此路径 C:\Documents and Settings\{user name}\Local Settings\Temp 在Windows 2000（32位）、XP及Server 2003（32位）系统上，或 C:\Users\{user name}\AppData\Local\Temp 在Windows Vista、7、8、8.1、2008（64位）、2012（64位）及10（64位）系统上。）

它会添加以下进程：

• vssadmin delete shadows /all /quiet & wmic shadowcopy delete
• bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
• wbadmin delete catalog -quiet
• chcp 65001
• taskkill /F /IM {pid of malware}
• timeout /T 10 /Nobreak
• Del /a /f / q {malware full path}
• Del /a /f / q {malware execution path}\DotNetZip.dll
• Del /a /f / q {malware execution path}\Newtonsoft.Json.dll

其他系统修改

This Trojan Spy adds the following registry entries to disable the Task Manager:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = 1

它将系统桌面壁纸设置为以下图像：

进程终止

This Trojan Spy terminates the following services if found on the affected system:

• BackupExecAgentBrowser
• BackupExecDiveciMediaService
• BackupExecJobEngine
• BackupExecManagementService
• vss
• sql
• svc$
• memtas
• sophos
• veeam
• backup
• GxVss
• GxBlr
• GxFWD
• GxCVD
• GxCIMgr
• DefWatch
• ccEvtMgr
• SavRoam
• RTVscan
• QBFCService
• Intuit.QuickBooks.FCS
• YooBackup
• YooIT
• zhudongfangyu
• sophos
• stc_raw_agent
• VSNAPVSS
• QBCFMonitorService
• VeeamTransportSvc
• VeeamDeploymentService
• VeeamNFSSvc
• veeam
• PDVFSService
• BackupExecVSSProvider
• BackupExecAgentAccelerator
• BackupExecRPCService
• AcrSch2Svc
• AcronisAgent
• CASAD2DWebSvc
• CAARCUpdateSvc
• TeamViewer

Information Theft

该木马间谍程序会收集以下数据：

• Username
• Hostname
• Battery Life
• Clipboard Data
• List of Installed Applications
• OS Version
• OS Product Key
• List of Installed AV Products

其他信息

该木马间谍程序会执行以下操作：

• It sets its own file attributes to SYSTEM and HIDDEN.
• It can disable the task manager.
• It terminates and deletes itself after its encryption routine.
• It loads vaultcli.dll and calls its functions to retrieve all saved data from the following browsers:
  • Opera Software
  • Edge
  • Firefox
  • Internet explorer
• It steals information from the following VPN services:
  • NordVPN
  • OpenVPN
  • ProtonVPN
• It steals information from the following email clients:
  • DeskSoft
  • Foxmail
  • GetyMail2
  • Opera_Mail
  • Outlook
  • Pocomail
  • TrulyMail
  • yMail
  • yMail2
• It steals information from the following gaming platforms installed:
  • BattleNET
  • Steam
  • Uplay
• It steals information from the following password managers:
  • Enpass
  • KeePass
  • mSecure
  • NordPass
  • _Password
  • Wallets
• It steals information from the following file transfer tools:
  • AbleFTP14
  • BlazeFtp
  • Cyberduck
  • DeluxeFTP
  • Estsoft
  • Far
  • FTPBox
  • FTPGetter
  • FTP_Now
  • FTPShell
  • GetAutomize14
  • GetFileZilla
  • GoFTP
  • INSoftware
  • iterate_GmbH
  • JaSFtp14
  • NetDrive2
  • NexusFile
  • Odin_Secure_FTP_Expert
  • SftpNetDrive
  • Staff_FTP
  • UltraFXP
  • WS_FTP
• It steals information from the following messaging platforms:
  • Discord
  • GetPaltalk
  • QQ
  • SignalGetJSON
  • SignalGetSQL
  • Skype
  • Telegram
  • TOX
  • Viber
  • Vime
  • WickrMe
  • Wickr_Pro
  • Pidgin
• It steals information from the following system/file management tools:
  • ExpanDrive
  • GetTotalCommander
  • Ipswitch
  • SuperPutty
  • Syncovery
• It steals the following browser information:
  • Web Data
  • Login Data
  • Cookies
  • History
  • History
  • Web Data
  • Bookmarks
  • CreditCards.txt
  • Passwords.txt
  • Cookies.txt
  • History.txt
  • Downloads.txt
  • AutoFill.txt
  • Bookmarks.txt

Ransomware Routine

This Trojan Spy encrypts files with the following extensions:

• pdf
• rtf
• doc
• docx
• xls
• xlsx
• ppt
• pptx
• odt
• indd
• txt
• json
• torrent
• rdp
• vn
• contact
• dat
• db3
• db4
• kdb
• kdbx
• sql
• sqlite
• mdb
• dsk
• dbf
• walle
• vb
• c
• cs
• cpp
• asm
• sh
• py
• pyw
• html
• css
• php
• go
• js
• rb
• pl
• swift
• java
• kt
• kts
• ino
• mafil
• jpg
• jpeg
• png
• bm
• tar
• Z
• ace
• pea
• sfx
• AR

它会避免加密文件名中包含以下字符串的文件：

• boot.ini
• bootfont.bin
• boot.ini
• iconcache.db
• ntuser.dat
• ntuser.dat.log
• ntuser.ini
• thumbs.db
• autorun.inf
• bootsect.bak
• bootmgfw.efi
• desktop.ini

该程序会避免加密文件路径中包含以下字符串的文件：

• appdata\local
• appdata\locallow
• users\all users
• \ProgramData

它会避免加密以下文件夹中的文件：

• Program Files
• Program Files (x86)
• Windows
• $Recycle.Bin
• MSOCache
• Documents and Settings
• Intel
• PerfLogs
• Windows.old
• AMD
• NVIDIA
• ProgramData

它会为加密文件的文件名添加以下扩展名：

• {original filename}.{original extension}.{4 random alphanumeric}

它会释放以下文件作为勒索信：

• {encrypted directory}\read_it.txt