HackTool.Win32.OneKeyRe.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Dateien ein:

• %System Root%\Boot\BCD_.LOG{Number}
• %System Root%\okldr
• %System Root%\okldr.mbr
• %System Root%\YlmF.ima
• %System Root%\Ghost.ba_
• %User Temp%\Ghost.exe
• %User Temp%\WimaDll.dll
• {Backup Path}\{Backup Filename} → set by the user when creating a backup of the system

(Hinweis: %System Root% ist der Stammordner, normalerweise C:\. Dort befindet sich auch das Betriebssystem.. %User Temp% ist der Ordner 'Temp' des aktuellen Benutzers, normalerweise C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Temp unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Local\Temp unter Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)

Fügt die folgenden Prozesse hinzu:

• %System%\BCDEdit.exe /export %System Root%\Boot\BCD_
• %System%\BCDEdit.exe /create {GUID} /d "OneKey Recovery" /application bootsector
• %System%\BCDEdit.exe /set {GUID} path \okldr.mbr
• %System%\BCDEdit.exe /displayorder {GUID} /addlast
• %System%\BCDEdit.exe /timeout 3
• %System%\BCDEdit.exe /default {GUID}
• %System%\BCDEdit.exe /set {GUID} device partition=\Device\HarddiskVolume1

(Hinweis: %System Root% ist der Stammordner, normalerweise C:\. Dort befindet sich auch das Betriebssystem.)

Andere Details

Es macht Folgendes:

• The dropped Ghost.ba_ contains the following batch commands:
  • Ghost.exe -noide -nousb -clone,mode=pdump,src="{Source Partition Index}",dst="{Destination Partition Index}\Ghost\Bak.GHO" -fr restart
• It is a system backup and restore tool that allows users to create a full system image and restore it when needed.
• It integrates Norton Ghost as its core engine for disk imaging and restoration.
• It offers options to restore or back up the operating system.
• It allows users to install or repair the recovery system.
• It contains a field that allows users to select or input the location of the backup image file.
• It displays all detected drives and partitions which includes the following information:
  • Partition Sequence
  • Volume Label
  • File System Format
  • Free Space
  • Total Capacity
• It allows users to select specific drives or partitions for restoration or backup.
• It allows users to search for backup files such as .GHO within a specified directory depth.
• It offers the following compression levels:
  • No Compression
  • Fast Compression
  • High Compression
  • Maximum Compression
• Users can choose between the following Ghost versions:
  • 11.0.2
  • 11.5.1
  • Other Ghost executables provided by the user
• It has an option to disable access to IDE devices during backup operations.
• It allows users to choose between the operating system boot menu or a hotkey for recovery.
• It provides the following hotkey options for triggering the recovery process during boot:
  • F7
  • F8
  • F10
  • F11
  • F12