ESET Sednit USBStealer 2014

USBStealer automatically exfiltrates collected files via removable media when an infected device connects to an air-gapped victim machine after initially being connected to an internet-enabled victim machine.

Once a removable media device is inserted back into the first victim, USBStealer collects data from it that was exfiltrated from a second victim.

Most strings in USBStealer are encrypted using 3DES and XOR and reversed.

USBStealer mimics a legitimate Russian program called USB Disk Security.

USBStealer exfiltrates collected files via removable media from air-gapped victims.

USBStealer has several commands to delete files associated with the malware from the victim.

USBStealer sets the timestamps of its dropper files to the last-access and last-write timestamps of a standard Windows library chosen on the system.

USBStealer collects files matching certain criteria from the victim and stores them in a local directory for later exfiltration.

USBStealer searches victim drives for files matching certain extensions (“.skr”,“.pkr” or “.key”) or names.

USBStealer drops itself onto removable media and relies on Autorun to execute the malicious file when a user opens the removable media on another system.

USBStealer drops commands for a second victim onto a removable media drive inserted into the first victim, and commands are executed when the drive is inserted into the second victim.

For all non-removable drives on a victim, USBStealer executes automated collection of certain files for later exfiltration.

USBStealer monitors victims for insertion of removable drives. When dropped onto a second victim, it also enumerates drives connected to the system.

USBStealer registers itself under a Registry Run key with the name "USB Disk Security."