Win32/Potao

it does contain a few other interesting techniques that ‘get the job done’, like the mechanism for spreading via USB drives

sending personalized SMS messages to their potential victims to lure them to landing pages hosting the malware, disguised as postal tracking sites

the website truecryptrussia.ru has been serving modified versions of the encryption software that included a backdoor to selected targets. Clean versions of the application are served to normal visitors

The Potao trojan-droppers arrived (commonly via phishing emails) at victims’ systems in the form of executables with the icon of a Microsoft Word document, to trick the users into opening them and thereby running the malware.

someone trying to impersonate him was sending out spear phishing emails to members of MMM that contained a link to malware hosted on Dropbox.

they began sending personalized SMS messages to their potential victims to lure them to landing pages hosting the malware, disguised as postal tracking sites

This social engineering trick has fooled a number of victims into “willingly” running the malware.

The trojan uses standard methods for loading its DLL – via rundll32.exe – and for maintaining persistence, by setting the Run registry entry: [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] %LUID%

The DLL is dropped to the following path, loaded and injected into explorer.exe... this instance will try to inject itself into the address space of several running legitimate and Internet-facing processes

The trojan uses standard methods for loading its DLL – via rundll32.exe – and for maintaining persistence, by setting the Run registry entry: [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] %LUID%

This algorithm is also often used for hashing function names... if you look at the source code of the Conti ransomware leak, you can see Murmurhash2A function... hashing Win32API functions via MurmurHash2A.

static LPVOID getAPIAddr(HMODULE h, unsigned int myHash) { ... if (MurmurHash2A(pFuncName, strlen(pFuncName), 0) == myHash) { ... return (LPVOID)((LPBYTE)h + fAddr[fOrd[i]]); } }

The communication uses strong cryptography in two stages. The first stage is the key exchange and the second stage is the actual exchange of data.

disguising executables as Word and Excel documents

The DLL is dropped to the following path, loaded and injected into explorer.exe... this instance will try to inject itself into the address space of several running legitimate and Internet-facing processes

Poker2.dll... Disables spreading through USB drives, deletes specific Registry keys, and kills processes belonging to the malware.

some of the plugins we observed during our monitoring of the Potao botnet were signed with a certificate issued to “Grandtorg”

The trojan uses standard methods for loading its DLL – via rundll32.exe

At the same time, all other files and folders that were already present on the drive have their attributes set to Hidden and System.

KeyLog2Runner.dll... Logs key strokes & clipboard data from most common Internet browsers and Skype.

PasswordStealer.dll... Decrypts and steals passwords and settings from different browsers and email clients.

GetAllSystemInfo.dll... Collects various kinds of system information, including: system identifying information, proxy and language settings, lists of processes, installed software, recently opened files, and so on.

Enumerates all drives and creates a list of potentially interesting files: images and documents.

It collects browsing history from Google Chrome, Mozilla Firefox and Opera.

Collects various kinds of system information, including: system identifying information, proxy and language settings, lists of processes, installed software, recently opened files, and so on.

it does contain a few other interesting techniques that ‘get the job done’, like the mechanism for spreading via USB drives

KeyLog2Runner.dll... Logs key strokes & clipboard data from most common Internet browsers and Skype.

Screen.dll Light Captures screenshots.

KeyLog2Runner.dll... Logs key strokes & clipboard data from most common Internet browsers and Skype.

The plugins are downloaded each time the malware starts, since they aren’t stored on the hard drive.