TrojanSpy.Win32.TRICKBOT.AK
Trojan.Win32.Mansabo.boq (Kaspersky) ; Trojan:Win32/MereTam.A (Microsoft)
Windows
恶意软件类型:
Trojan Spy
有破坏性？:
没有
加密？:
是的
In the Wild:
是的
概要
它以电子邮件消息附件的形式出现，而此垃圾邮件由其他恶意软件/灰色软件/间谍软件或恶意用户发送。
它会从系统和/或用户窃取特定信息。
它连接到某个网站，发送和接收信息。
技术详细信息
新病毒详细信息
它以电子邮件消息附件的形式出现，而此垃圾邮件由其他恶意软件/灰色软件/间谍软件或恶意用户发送。
安装
它在受感染的系统中植入下列自身副本：
- %Application Data%\WINYS\{malware file name}.exe
- %System Root%\mswvc.exe
- %System%\mswvc.exe
(注意: %Application Data% 是当前用户的 Application Data 文件夹，通常位于 C:\Windows\Profiles\{user name}\Application Data (Windows 98 和 ME)、C:\WINNT\Profiles\{user name}\Application Data (Windows NT)、C:\Documents and Settings\{user name}\Local Settings\Application Data (Windows 2000(32-bit)、XP 和 Server 2003(32-bit)) 和 C:\Users\{user name}\AppData\Roaming (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit) 和 10(64-bit))。
(注意： %System Root% 是根文件夹，通常位于 C:\。它也是操作系统所在的位置。. %System% 是 Windows 的 system 文件夹，通常位于 C:\Windows\System (Windows 98 和 ME)、C:\WINNT\System32 (Windows NT 和 2000) 和 C:\WINDOWS\system32 (Windows 2000(32-bit)、XP、Server 2003(32-bit)、Vista、7、8、8.1、2008(64-bit),2012(64bit) 和 10(64-bit))。)
它植入下列文件：
- %Application Data%\WINYS\settings.ini -> Contains Encrypted Victim Key
- %Application Data%\WINYS\Data\importDll32 -> Encrypted module that steals information from Internet Applications
- %Application Data%\WINYS\Data\injectDll32 -> Encrypted module that monitors banking-related URLs and/or websites
- %Application Data%\WINYS\Data\mailsearcher32 -> Encrypted module that steals email from files in the infected machine
- %Application Data%\WINYS\Data\networkDll32 -> Encrypted module that steals network information
- %Application Data%\WINYS\Data\pwgrab32 -> Encrypted module that steals information from Internet Browser Applications, WinSCP, FileZilla, and Microsoft Outlook
- %Application Data%\WINYS\Data\systeminfo32 -> -> Encrypted module that steals information regarding the infected machine
- %Application Data%\WINYS\Data\tabDll32 -> Encrypted module that provides the propagation of the malware
- %Application Data%\WINYS\Data\shareDll32 -> Encrypted module that provides propagation via SMB
- %Application Data%\WINYS\Data\wormDll32 -> Encrypted module that provides propagation via SMB
- %Application Data%\WINYS\Data\injectDll32_configs\dinj -> Encrypted list of banking-related URLs and/or websites to monitor
- %Application Data%\WINYS\Data\injectDll32_configs\dpost -> Encrypted list of C&C servers that will receive the HTTP response to and from the monitored URLs and/or websites
- %Application Data%\WINYS\Data\injectDll32_configs\sinj -> Encrypted list of banking-related URLs and/or websites to phish
- %Application Data%\WINYS\Data\mailsearcher32_configs\mailconf -> Encrypted list of C&C servers that will receive the stolen email addresses
- %Application Data%\WINYS\Data\networkDll32_configs\dpost -> Encrypted list of C&C servers that will receive the stolen network information
- %Application Data%\WINYS\Data\pwgrab32_configs\dpost -> Encrypted list of C&C servers that will receive the credentials
- %Application Data%\WINYS\Data\psfin32 -> Encrypted module that identifies Point-Of-Sale systems within the network
(注意: %Application Data% 是当前用户的 Application Data 文件夹，通常位于 C:\Windows\Profiles\{user name}\Application Data (Windows 98 和 ME)、C:\WINNT\Profiles\{user name}\Application Data (Windows NT)、C:\Documents and Settings\{user name}\Local Settings\Application Data (Windows 2000(32-bit)、XP 和 Server 2003(32-bit)) 和 C:\Users\{user name}\AppData\Roaming (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit) 和 10(64-bit))。)
它创建下列文件夹：
- %Application Data%\WINYS
- %Application Data%\WINYS\Data
(注意: %Application Data% 是当前用户的 Application Data 文件夹，通常位于 C:\Windows\Profiles\{user name}\Application Data (Windows 98 和 ME)、C:\WINNT\Profiles\{user name}\Application Data (Windows NT)、C:\Documents and Settings\{user name}\Local Settings\Application Data (Windows 2000(32-bit)、XP 和 Server 2003(32-bit)) 和 C:\Users\{user name}\AppData\Roaming (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit) 和 10(64-bit))。)
自启动技术
它會新增並執行下列服務：
- Service Name: {random letters}
- ImagePath: %System Root%\mswvc.exe or %System%\mswvc.exe
- DisplayName: Can be either of the following:
- ServiceTechno4
- Service_Techno4
- Technics-service3
- TechnoServices3
- Advanced-TechnicService0
- ServiceTechno6
- NewServiceTech3
- Techserver6
(注意: %System% 是 Windows 的 system 文件夹，通常位于 C:\Windows\System (Windows 98 和 ME)、C:\WINNT\System32 (Windows NT 和 2000) 和 C:\WINDOWS\system32 (Windows 2000(32-bit)、XP、Server 2003(32-bit)、Vista、7、8、8.1、2008(64-bit),2012(64bit) 和 10(64-bit))。)
信息窃取
它会窃取以下信息:
- Information regarding Point-Of-Sale (POS) systems in the network, by querying accounts or user name containing the following string:
- *POS*
- *REG*
- *CASH*
- *LANE*
- *STORE*
- *RETAIL*
- *BOH*
- *ALOHA*
- *MICROS*
- *TERM*
- OS information (Architecture, Caption, CSDVersion)
- CPU Information (Name)
- Memory Information
- User Accounts
- Installed Programs
- Installed Services
- IP Configuration
- Network Information (Configuration, Users, Domain Settings)
- Email addresses
- Credentials in the following Applications:
- Microsoft Outlook
- Filezilla
- WinSCP
- Internet Credentials (Internet Explorer, Microsoft Edge, Google Chrome, Mozilla Firefox):
- Usernames and Passwords
- Internet Cookies
- Browsing History
- Autofills
- HTTP Posts responses
其他详细信息
它连接到下列网站，发送和接收信息：
- https://{BLOCKED}.{BLOCKED}.85.215:446
- http://{BLOCKED}.{BLOCKED}.181.125:8082
- http://{BLOCKED}.{BLOCKED}.167.72:8082
- http://{BLOCKED}.{BLOCKED}.252.178:8082
- http://{BLOCKED}.{BLOCKED}.100.152:8082
- http://{BLOCKED}.{BLOCKED}.87.38:8082
- http://{BLOCKED}.{BLOCKED}.128.34:80
- http://{BLOCKED}.{BLOCKED}.69.68:80
- http://{BLOCKED}.{BLOCKED}.181.1:80
- http://{BLOCKED}.{BLOCKED}.184.101:80
- http://{BLOCKED}.{BLOCKED}.103.74:80
- http://{BLOCKED}.{BLOCKED}.138.220:443
- http://{BLOCKED}.{BLOCKED}.252.204:443
- http://{BLOCKED}.{BLOCKED}.250.156:443
- http://{BLOCKED}.{BLOCKED}.65.26:443
- http://{BLOCKED}.{BLOCKED}.135.241:443
- {BLOCKED}.{BLOCKED}.149.175:443
- {BLOCKED}.{BLOCKED}.186.151
- {BLOCKED}.{BLOCKED}.138.170:443
解决方案
Step 1
对于Windows ME和XP用户，在扫描前，请确认已禁用系统还原功能，才可全面扫描计算机。
Step 2
请注意，在执行此恶意软件/间谍软件/灰色软件期间，并非所有文件、文件夹、注册表项和条目都安装在您的计算机上。这可能是由于安装不完整或其他操作系统条件造成的。如果找不到相同的文件/文件夹/注册表信息，请继续下一步。
Step 3
若要删除此恶意软件/灰色软件/间谍软件创建的随机服务键值，请执行下列步骤:
- 使用亚信安全产品扫描您的计算机，然后记录检测到的恶意软件/灰色软件/间谍软件的名称。
- 打开注册表编辑器。要执行此操作，请单击“开始”>“运行”，在提供的文本框中输入 regedit，然后按 Enter。
- 按 CTRL+F。
- 在“查找”对话框中，输入先前检测到的恶意软件的文件名。
(注意: 请确保仅选中数据复选框，然后单击“查找下一个”。) - 找到后，在右侧面板中，检查结果是否为下列值-数据对:
ImagePath = {Malware/Grayware/Spyware path and file name} - 如果是，则在左侧面板中，找到数据所在的服务。
- 在左侧面板中右键单击找到的服务，然后选择“删除”。
- 重复第 2 步到第 6 步，直至出现“注册表搜索完毕”对话框。
- 关闭注册表编辑器。
Step 4
Deleting Scheduled Tasks
The following {Task Name} - {Task to be run} listed should be used in the steps identified below:
- Sysnetsf - %Application Data%\WINYS\{malware file name}.exe
For Windows 2000, Windows XP, and Windows Server 2003:
- Open the Windows Scheduled Tasks. Click Start>Programs>Accessories>
System Tools>Scheduled Tasks. - Locate each {Task Name} values listed above in the Name column.
- Right-click on the said file(s) with the aforementioned value.
- Click on Properties. In the Run field, check for the listed {Task to be run}.
- If the strings match the list above, delete the task.
For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:
- Open the Windows Task Scheduler. To do this:
• On Windows Vista, Windows 7, and Windows Server 2008, click Start, type taskschd.msc in the Search input field, then press Enter.
• On Windows 8, Windows 8.1, and Windows Server 2012, right-click on the lower left corner of the screen, click Run, type taskschd.msc, then press Enter. - In the left panel, click Task Scheduler Library.
- In the upper-middle panel, locate each {Task Name} values listed above in the Name column.
- In the lower-middle panel, click the Actions tab. In the Details column, check for the {Task to be run} string.
- If the said string is found, delete the task.
Step 5
搜索和删除这一文件夹
- %Application Data%\WINYS
Step 6
重启进入正常模式，使用亚信安全产品扫描计算机，检测TrojanSpy.Win32.TRICKBOT.AK文件 如果检测到的文件已被亚信安全产品清除、删除或隔离，则无需采取进一步措施。可以选择直接删除隔离的文件。请参阅知识库页面了解详细信息。