Win32/Bagopos

Installation

Threats in this family can create copies of themselves to the following locations:

• %APPDATA% \java\javaupdate.exe
• APPDATA% \java\javaj.exe
• %APPDATA% \svchost\svchost.exe

They can also create the following files on your PC:

• %APPDATA% \java\dllx64.dll - the malware uses this file to hook into running processes to allow memory scraping of credit card information. 

It changes the following registry entries so that it runs each time you start your PC:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "Java Update Manager"
With data: "%APPDATA%\java\javaj.exe"

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "javaj"
With data: "%APPDATA%\svchost\svchost.exe"

Payload

Steals your sensitive information

Threats in this family can steal your sensitive information. We have seen some threats use memory scraping to search for credit card details stored on your PC.

We have also seen threats in this family steal passwords for remote desktop software, such as RealVNC, TightVNC, TigerVNC, Ultravnc2, and WinVNC4. This can give a malicious hacker access to a compromised machine to  perform a number of actions, including downloading other malware and stealing your sensitive information.

The stolen information is sent to a remote server. We have seen it connect to the following hosts using port 80:

• 37.46.<removed>.253
• 80.82.<removed>.23
• 179.43.<removed>.69
• 185.60.<removed>.22
• 193.109.<removed>.58  

The malware can also contacts the remote host to:

• Report a new infection to its author
• Receive configuration or other data
• Download and run files, including updates or other malware
• Receive instructions from a remote hacker

Lowers system security settings

Threats in this family set common malware file types as "low-risk" to prevent your PC showing a security alert when these file types are downloaded. The malware does this by making the following registry change:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations
Sets value: "LowRiskFileTypes"
With data: ".exe;.bat;.reg;.vbs;"

Changes your browser settings

This malware can lower your web browser security settings by creating the following registry keys:

In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
Sets value: "1806"
With data: "0"

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
Sets value: "1806"
With data: "0"

Analysis by Marianne Mallen