TrojanSpy.MSIL.REDLINESTEALER.YXBDN

它以文(wén)件的形式出现在系统中(zhōng)，可(kě)能(néng)是其他(tā)恶意软件投放的，或者是用(yòng)户在访问恶意网站时无意中(zhōng)下载的。

它执行遠(yuǎn)程恶意用(yòng)户的命令，有(yǒu)效地攻击受感染的系统。 它连接到网站，发送和接收信息。

新(xīn)病毒详细信息

它以文(wén)件的形式出现在系统中(zhōng)，可(kě)能(néng)是其他(tā)恶意软件投放的，或者是用(yòng)户在访问恶意网站时无意中(zhōng)下载的。

安(ān)装(zhuāng)

它添加下列进程：

• {Malware Directory}\{Malware Filename}

它向下列进程中(zhōng)注入代码：

• {Malware Directory}\{Malware Filename}

后门例程

它执行遠(yuǎn)程恶意用(yòng)户的下列命令：

• Download - downloads a file to specified path
• DownloadAndEx - downloads a file to specified path then execute it
• OpenLink - opens a specific link in the browser
• Cmd - execute commands via cmd

它连接到下列网站，发送和接收信息：

• {BLOCKED}ri.xyz:80

信息窃取

它收集下列数据:

• Gathers the following system info:
  • Username
  • Hardware ID
  • Keyboard Layout
  • Screenshot
  • Screen Resolution
  • Operating System
  • UAC Settings
  • Is Admin
  • GPU Information
  • CPU Information
  • Memory (RAM)
  • Installed Antiviruses
  • IP Address
  • Country
  • City
  • ZipCode
  • System Language
  • System Timezone
  • Installed Programs
  • Running Processes
• Gathers Info from:
  • Browsers:
    • Chrome Based Browsers
    • Gecko Based Browsers (e.g. Firefox)
  • FTP Clients:
    • FileZilla
  • Messaging Applications:
    • Telegram
  • VPN:
    • NordVPN
    • OpenVPN
    • ProtonVPN
  • Wallets:
    • Armory
    • Atomic
    • Coinomi
    • Electrum
    • Ethereum
    • Exodus
    • Guarda
    • Jaxx
    • Metamask
    • Monero
    • Tron
    • Others
  • Others:
    • Steam
    • Discord

其他(tā)详细信息

该程序执行以下操作(zuò)：

• Shows fake error message:
  • MesageBox Title: System Error
  • MessageBox Content: "The code execution cannot proceed because MSVCP140.dll was not found"