Trojan.Win32.BABUK.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Agrega las carpetas siguientes:

• %User Temp%\is-{random}.tmp

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).

Infiltra los archivos siguientes:

• %User Temp%\is-{random}.tmp\{Malware Name}.tmp
• {Specified Installation Path}\Temp\logon.bat → detected as Trojan.BAT.BABUK.YACGY
• {Specified Installation Path}\Temp\svchost.exe → detected as Ransom.Win32.BABUK.YACGY
• {Specified Installation Path}\Temp\HelpPane.exe → detected as Trojan.Win32.KILLAV.WLEBB
• {Specified Installation Path}\Temp\mhyprot2.sys → deleted afterwards

Agrega los procesos siguientes:

• "%User Temp%\is-{random}.tmp\{Malware Name}.tmp" /SL5="{random},{random},{random},{Malware Path and Name}"
• %System%\cmd.exe /C "{Specified Installation Path}\Temp\logon.bat"

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).

Robo de información

Acepta los siguientes parámetros:

• /HELP or /? - displays a window that shows a complete list of the possible arguments that can be used
• /SP - Disables the "This will install... Do you wish to continue?" prompt at the beginning of Setup
• /SILENT, /VERYSILENT - causes installation to be silent or very silent
• /SUPPRESSMSGBOXES - suppresses message boxes upon installation
• /LOG - create a log file in the user's TEMP directory
• /LOG={filename} - creates a log file using a specified file path/filename
• /NOCANCEL - prevents the user from cancelling during the installation process
• /NORESTART - prevents setup from restarting the system following a successful installation, or after a Preparing to Install failure that requests a restart
• /RESTARTEXITCODE={exit code} - specifies a custom exit code that setup is to return when the system needs to be restarted
• /CLOSEAPPLICATIONS - closes applications using files that need to be updated upon installation
• /NOCLOSEAPPLICATIONS - prevents from closing applications using files that need to be updated upon installation
• /FORCECLOSEAPPLICATIONS - force closes applications that needs to be terminated upon installation
• /FORCENOCLOSEAPPLICATIONS - prevents from force closing applications
• /LOGCLOSEAPPLICATIONS - creates extra logging when closing applications for debugging purposes
• /RESTARTAPPLICATIONS - restart applications if possible or needed
• /NORESTARTAPPLICATIONS - prevents from restarting applications
• /LOADINF={filename} - loads the settings from the specified file after having checked the command line
• /SAVEINF={filename} - save installation settings to the specified file
• /LANG={language} - specifies the internal name of the language to use
• DIR={x:\dirname} - overrides the default directory name
• /GROUP={folder name} - overrides the default folder name
• /NOICONS - initially checks the "Don't create a Start Menu folder" check box
• /TYPE={type name} - overrides the default setup type
• /COMPONENTS={comma separated list of component names} - overrides the default component settings
• /TASKS={comma separated list of task names} - specifies a list of tasks that should be initially selected
• /MERGETASKS={comma separated list of task names} - like the /TASKS parameter, except the specified tasks will be merged with the set of tasks that would have otherwise been selected by default.
• /PASSWORD={password} - apecifies the password to use.

Otros detalles

Hace lo siguiente:

• It will display a fake AVG Installer Security System Setup which lets the user choose the installation path