Napolar

all important WINAPI functions from KERNEL32.DLL, NTDLL.DLL, WININET.DLL, WS2_32.DLL, SHLWAPI.DLL, PSAPI.DLL are resolved by CRC32 hash

An initial binary comes in the form of an SFX archive named in a similar fashion as Photo_021-WWW.FACEBOOK.COM.exe that handles two events: A silent execution of the Trojan's dropper and the display of a distracting image of girls

the bot after installation into %AppData\lsass.exe starts its instance at newly allocated memory at the virtual address 0xFE0000 and terminates itself. That means that it cannot be identified in the list of running processes.

the bot after installation into %AppData\lsass.exe starts its instance at newly allocated memory at the virtual address 0xFE0000 and terminates itself. That means that it cannot be identified in the list of running processes.

The initial x86 part also serves for a recognition of the system's architecture. In the case of a 64bit system, a correspondent module is extracted and loaded.

Also a few anti-debugging tricks related with IsDebuggerPresent and OutputDebugString functions have been observed.

we observed that the content of forms of internet banking sites were sent to C&C in an unencrypted form

The initial x86 part also serves for a recognition of the system's architecture. In the case of a 64bit system, a correspondent module is extracted and loaded.

Also a few anti-debugging tricks related with IsDebuggerPresent and OutputDebugString functions have been observed.

we observed that the content of forms of internet banking sites were sent to C&C in an unencrypted form

There were relevant strings ... indicating the possibility of man-in-the-browser attacks. Indeed, we observed that the content of forms of internet banking sites were sent to C&C in an unencrypted form

We have seen implemented functionalities like FTP and POP3 Grabber

An initial HTTP POST request for getting a command to be executed looks like this: POST / HTTP/1.1

We have seen implemented functionalities like FTP and POP3 Grabber, Reverse Socks 5

for a command related to a download, it is a URL to a file followed by a control hash and a decryption key... for an installation of additional binaries serves command 0x2, e.g. a download of the Bitcoin wallet stealing plugin called WalletSteal.bin

After a successful request, a response follows. As we mentioned, it is encrypted with RC4 and the right key is sent unencrypted in the POST query.