Trojan.Win64.BAZARLOADER.FAJG

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart-Technik

Erstellt folgende Registrierungseinträge, um die eingeschleuste Komponente bei jedem Systemstart automatisch auszuführen:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{Random Characters} = "%System%\rundll32.exe\" "{Malware Fullpath}", {Export} {First Argument} {Second Argument} {Third Argument}

Andere Details

Es macht Folgendes:

• It checks if it is executed with the following arguments:
• If it is executed without argument:
  
  • It adds one of the following process randomly:
    
    • cmd /c timeout /t 6 & "%System%\rundll32.exe" "{Malware Fullpath}", {Export} {First Argument} {Second Argument} & exit
    • cmd /c choice /n /c y /d y /t 6 & "%System%\rundll32.exe" "{Malware Fullpath}", {Export} {First Argument} {Second Argument} & exit
    • cmd /c timeout 10 /nobreak & "%System%\rundll32.exe" "{Malware Fullpath}", {Export} {First Argument} {Second Argument} & exit
    • cmd /c ping 192.0.2.210 -n 8 -i 103 -4 -w 1000 > NUL & "%System%\rundll32.exe" "{Malware Fullpath}", {Export} {First Argument} {Second Argument} & exit
• If it is executed with two specified arguments:
  
  • It adds the following process:
    
    • cmd.exe /c reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v 0q0ci6sB1gW5cD8sS6T /t REG_SZ /d "\"%System%\rundll32.exe\" \"{Malware Fullpath}\", {Export} {First Argument} {Second Argument} {Third Argument}"
  • It adds one of the following process randomly:
    • cmd /c timeout /t 6 & "%System%\rundll32.exe" "{Malware Fullpath}", {Export} {First Argument} {Second Argument} {Third Argument} & exit
    • cmd /c choice /n /c y /d y /t 6 & "%System%\rundll32.exe" "{Malware Fullpath}", {Export} {First Argument} {Second Argument} {Third Argument} & exit
    • cmd /c timeout 10 /nobreak & "%System%\rundll32.exe" "{Malware Fullpath}", {Export} {First Argument} {Second Argument} {Third Argument} & exit
    • cmd /c ping 192.0.2.210 -n 8 -i 103 -4 -w 1000 > NUL & "%System%\rundll32.exe" "{Malware Fullpath}", {Export} {First Argument} {Second Argument} {Third Argument} & exit
• If it is executed with three specified arguments:
  
  • It adds the following process:
    • cmd.exe /c reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths"
    • cmd.exe /c reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" /v "Path"
    • "%Program Files%\Google\Chrome\Application\chrome.exe" {First Argument} {Second Argument} {Third Argument} {Fourth Argument} "{Malware Fullpath}" "rundll32.exe" {Export}
• It injects malicious code to the added process, chrome.exe. --> will only work if executed on Windows 10

(Hinweis: %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) and 10(64-bit).. %Program Files%ist der Standardordner 'Programme', normalerweise C:\Programme.)