Trojan.BAT.BATCLOAK.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Prozesse hinzu:

• copy C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /y "{File name}.exe"
• {File Name}.exe -noprofile -ep bypass -c {encrypted command}

Andere Details

Es macht Folgendes:

• It encrypts files using Rjindael (AES) encryption.
• It displays the following screen after it finishes encrypting files:
  
• It contains an encrypted payload and executes it in memory.