Trojan.MSIL.WHISPERGATE.YXCAQ

感染途徑: ???????

它以文(wén)件的形式出现在系统中(zhōng)，可(kě)能(néng)是其他(tā)恶意软件投放的，或者是用(yòng)户在访问恶意网站时无意中(zhōng)下载的。

文(wén)件大小(xiǎo): 280,064 bytes

报告日期: DLL

内存驻留: 是的

初始樣本接收日期: 2022年1月17日

Payload: ??? URL/Ip, ????, ????

N

???????

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

??

???????:

%User Temp%\Nmddfrqqrbyjeygggda.vbs
%User Temp%\AdvancedRun.exe
%User Temp%\InstallUtil.exe

(??: %User Temp% ?????? Temp ???????? C:\Documents and Settings\{user name}\Local Settings\Temp (Windows 2000(32-bit)?XP ? Server 2003(32-bit))?C:\Users\{user name}\AppData\Local\Temp (Windows Vista?7?8?8.1?2008(64-bit)?2012(64-bit) ? 10(64-bit)?)

???????:

powershell.exe -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwAA== (Start-Sleep -s 10)
"%System%\WScript.exe" "%User Temp%\Nmddfrqqrbyjeygggda.vbs"
"%System%\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath 'c:\'
"%User Temp%\AdvancedRun.exe" /EXEFilename "%System%\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run
%User Temp%\AdvancedRun.exe" /EXEFilename "%System%\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 /CommandLine "rmdir '%ProgramData%\Microsoft\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run
%User Temp%\InstallUtil.exe

(??: %User Temp% ?????? Temp ???????? C:\Documents and Settings\{user name}\Local Settings\Temp (Windows 2000(32-bit)?XP ? Server 2003(32-bit))?C:\Users\{user name}\AppData\Local\Temp (Windows Vista?7?8?8.1?2008(64-bit)?2012(64-bit) ? 10(64-bit)?)

???????????:

%User Temp%\InstallUtil.exe

(??: %User Temp% ?????? Temp ???????? C:\Documents and Settings\{user name}\Local Settings\Temp (Windows 2000(32-bit)?XP ? Server 2003(32-bit))?C:\Users\{user name}\AppData\Local\Temp (Windows Vista?7?8?8.1?2008(64-bit)?2012(64-bit) ? 10(64-bit)?)

??????

?????????:

It downloads malicious DLL from the following URL and executes it in memory:
- https://cdn.discordapp.com/attachments/{BLOCKED}81184768/Tbopbh.jpg
It executes the following in memory:
- Trojan.Win32.WHISPERGATE.YXCAX

最小(xiǎo)扫描引擎: 9.800

First VSAPI Pattern File: 17.322.03

VSAPI 第一样式发布日期: 2022年1月18日

VSAPI OPR样式版本: 17.323.00

VSAPI OPR样式发布日期: 2022年1月19日

Step 1

??Windows ME?XP??,????,????????????,??????????

Step 2

注意：在此恶意软件/间谍软件/灰色软件执行期间，并非所有(yǒu)文(wén)件、文(wén)件夹和注册表键值和项都会安(ān)装(zhuāng)到您的计算机上。这可(kě)能(néng)是由于不完整的安(ān)装(zhuāng)或其他(tā)操作(zuò)系统条件所致。如果您没有(yǒu)找到相同的文(wén)件/文(wén)件夹/注册表信息，请继续进行下一步操作(zuò)。

Step 3

????????

[ 更多(duō) ]

??????????????????????????????????????,??????????????????

%User Temp%\Nmddfrqqrbyjeygggda.vbs
%User Temp%\AdvancedRun.exe
%User Temp%\InstallUtil.exe

Step 4

?????????????,???????Trojan.MSIL.WHISPERGATE.YXCAQ?? ????????????????????????,????????????????????????????????????????

概要

技(jì )术详细信息

解决方案