Trojan.DownLoader49.35687

SHA1:

• 4340beb5b7a15e9d1d8b1548f98454de49f0f958

Description

A phase 2 trojan in a multi-phase infection sequence that facilitates data theft, clipboard contents monitoring, backdoor deployment, rogue mining and infecting other files.

• Phase 1 — Trojan.DownLoader49.35384,
• Phase 2 — Trojan.DownLoader49.35687,
• Phase 3 — BackDoor.Siggen2.5906,
• Phase 4 — Trojan.Packed2.50953, Trojan.BtcMine.3956 — phase 5 downloader.

This trojan checks whether it is being run in a sandbox, connects to a C2 server, and deploys BackDoor.Siggen2.5906.

Operation

Step 1. The trojan determines whether it is being run in a sandbox. To accomplish this, it checks two system parameters. First, it uses the CreateDXGIFactory() function to check the video adapter name, which must not contain any of the following:

• unknown,
• Microsoft Basic Render,
• NVIDIA GeForce RTX 3060 Ti.

Then it validates the username., which must not match any of the names on the list below:

• george,
• Bruno,
• Abby,
• AMF,
• dx,
• John,
• elz,
• Admin.

If just one check fails, the trojan process ends.

Step 2. If the system has passed the sandbox checks, it creates the mutex synchronization object Global\PFNMX (a hardcoded value). An example of such an object: \Sessions\1\BaseNamedObjects\Global\PFNMX_0o6u9MMc2QdKvqeHmgPRE008. It enables the trojan to determine whether another instance of it has already been launched on the computer.

Step 3. The trojan accesses a raw file available on GitHub at raw[.] githubusercontent[.]com/XxXloverXxX/rustflare/refs/heads/main/crates/engine. The file is encoded with base64 and subsequently encrypted with XOR using ZwFlushKey. Once the data is decoded and decrypted, the trojan is able to extract C2 domain names from it.

LhI1GFsBDSgOFT8ENR4aHw07CRgjWSUDGA== - test.recklessroleplay[.]com

PhIwHgAdHCIIHHQUPw== - devruntime[.]cy

PhY0BwYaDC5LGiM= - darkside[.]cy

KB41CQYeGGULHC4= - risesmp[.]net

NAI8FgwADTkTEDkSNUIWHAU= - nuzzyservices[.]com

Certain Steam profiles are the trojan's alternative source of C2 domain names. Some of them contain information about the domain name in plain text.

The trojan also has a number of hardcoded domain names at its disposal. It picks one from the list, establishes a connection and downloads the phase 3 malware from https://*domain*/Stb/PokerFace/init[.]php?id=Elton. This malicious code is also encoded using base64.

Step 4. The trojan ensures that its file size exceeds 18 bytes and uses Process Inject to randomly inject it into one of the following processes:

  C:\Windows\System32\DiskSnapshot.exe
C:\Windows\System32\IESettingSync.exe
C:\Windows\System32\LegacyNetUXHost.exe
C:\Windows\System32\LockAppHost.exe
C:\Windows\System32\LsaIso.exe
C:\Windows\System32\PATHPING.EXE
C:\Windows\System32\SecureBootEncodeUEFI.exe
C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SgrmLpac.exe
C:\Windows\System32\Spectrum.exe
C:\Windows\System32\SppExtComObj.Exe
C:\Windows\System32\SyncHost.exe
C:\Windows\System32\TCPSVCS.EXE
C:\Windows\System32\TapiUnattend.exe
C:\Windows\System32\TieringEngineService.exe
C:\Windows\System32\UtcDecoderHost.exe
C:\Windows\System32\dllhost.exe
C:\Windows\System32\fontdrvhost.exe
C:\Windows\System32\icacls.exe
C:\Windows\System32\ktmutil.exe
C:\Windows\System32\label.exe
C:\Windows\System32\licensingdiag.exe
C:\Windows\System32\lodctr.exe
C:\Windows\System32\logman.exe
C:\Windows\System32\makecab.exe
C:\Windows\System32\mmgaserver.exe
C:\Windows\System32\mountvol.exe
C:\Windows\System32\netbtugc.exe
C:\Windows\System32\odbcconf.exe
C:\Windows\System32\pcalua.exe
C:\Windows\System32\print.exe
C:\Windows\System32\reg.exe
C:\Windows\System32\sc.exe
C:\Windows\System32\sdchange.exe
C:\Windows\System32\sihost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\sxstrace.exe
C:\Windows\System32\tttracer.exe
C:\Windows\System32\ucsvc.exe
C:\Windows\System32\unlodctr.exe

Step 5. The trojan creates the named pipe pipe\\ VccFrameworkchannel and uses it to transmit two values and the domain name it successfully used to download the phase 3 malware. Example QTuVl0PCseGLafunsZPRE008:0o6u9MMc2QdKvqeHmgPRE008:darkside[.]cy.

MITRE ATT@CK MATRIX

More about Trojan.DownLoader49.35384
More about BackDoor.Siggen2.5906
More about Trojan.BtcMine.3956
Indicators of Compromise
Trojan review