Trojan.BAT.BATCLOAK.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Agrega los procesos siguientes:

• copy C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /y "{File name}.exe"
• {File Name}.exe -noprofile -ep bypass -c {encrypted command}

Otros detalles

Hace lo siguiente:

• It encrypts files using Rjindael (AES) encryption.
• It displays the following screen after it finishes encrypting files:
  
• It contains an encrypted payload and executes it in memory.