BackDoor.SpyBotNET.79

SHA1 hash:

• c402d069a92bbc552c3ac6497547e10f45aca4f3

Description

A trojan spyware app written in C# and designed for computers running Microsoft Windows operating systems. It eavesdrops on users through the microphones it is able to access on infected devices, and, when it detects conversations, starts recording audio data to special files.

Operating routine

Initialization

Upon initialization, the trojan loads its settings from the configuration file and creates a working directory with the name specified in this configuration. This directory will be further used to write the malware’s files into it.

Logging actions

The trojan logs all the audio input devices (microphones) detected in a system, saving information about them to the cl.bindb file. In this file, the first line indicates the build version of the malicious app. This is followed by a list of detected devices that consists of data strings in the format of Device <index>: <name>, <channels_count> channels, where:

• <index> is the device number in the list;
• <name> is the device name;
• <channels_count> is the number of audio channels.

An example of the recorded data:

The malicious program constantly listens in on the environment through the microphone, recording a data block containing the sound information to RAM. The average value of the resulting bytes in the block is placed into the wd.bindb file. For example:

The db.bindb file stores the history of the rounded average values of the recorded bytes from the wd.bindb file. For example:

The resulting values of the sound intensity are compared with the target value from the configuration file, which allows the trojan to distinguish between moments of conversation and silence. Audio recordings are only made to this file when conversation occurs.

The audio recording itself is performed into a file with the <prefix><current_time><suffix_rec>, naming pattern, where:

• <prefix> is a constant, hardcoded into the configuration;
• <current_time> is the current time (in the yyyyMMddHHmmss format);
• <suffix_rec> is a constant, hardcoded into the configuration.

Indicators of compromise

News about the trojan