Trojan.DownLoad4.11892

The malware has a valid digital signature and is distributed among cryptocurrency enthusiasts. Upon launch it downloads and compiles source code using the .Net framework. Using the same code, it then downloads Trojan.PWS.Stealer.24943. The malware creators also use the 2n****.co service to collect information on the number of installs

Technical information

To ensure its auto-run and distribution, it modifies the following registry keys:

• [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '2themoon' = '<File path>'

Network activity

Connects to:

• '2n****.co':443
• 'coin****.io':80
• 'coin****.io':443
• 'raw.githubuserco****.com':443

TCP:

HTTP GET requests:

• http://coin****.io/front

UDP:

• DNS ASK 2n****.co
• DNS ASK coin****.io
• DNS ASK raw.githubuserco****.com

More options

The Trojan creates and runs the following in hidden windows:

• '<SYSTEM32>\wisptis.exe' /ManualLaunch;'
• '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\u1t33wpc.cmdline"'
• '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES948F.tmp" "%TEMP%\CSC3F93840EDD39419F8C70B8765AAF94.TMP"'

Executes the following:

• '<SYSTEM32>\wisptis.exe' /ManualLaunch;
• '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\u1t33wpc.cmdline"
• '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES948F.tmp" "%TEMP%\CSC3F93840EDD39419F8C70B8765AAF94.TMP"

News about the Trojan