Trojan.MSIL.KILLAV.C

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Diese Malware hat keine Verbreitungsroutine.

Diese Malware hat keine Backdoor-Routine.

Diese Malware kann keine Daten stehlen.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Prozesse hinzu:

• powershell Set-MpPreference -DisableRealtimeMonitoring $true
• powershell Set-MpPreference -DisableBehaviorMonitoring $true
• powershell Set-MpPreference -DisableBlockAtFirstSeen $true
• powershell Set-MpPreference -DisableIOAVProtection $true
• powershell Set-MpPreference -DisablePrivacyMode $true
• powershell Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
• powershell Set-MpPreference -DisableArchiveScanning $true
• powershell Set-MpPreference -DisableIntrusionPreventionSystem $true
• powershell Set-MpPreference -DisableScriptScanning $true
• powershell Set-MpPreference -SubmitSamplesConsent 2
• powershell Set-MpPreference -MAPSReporting 0
• powershell Set-MpPreference -HighThreatDefaultAction 6 -Force
• powershell Set-MpPreference -ModerateThreatDefaultAction 6
• powershell Set-MpPreference -LowThreatDefaultAction 6
• powershell Set-MpPreference -SevereThreatDefaultAction 6

Andere Systemänderungen

Ändert die folgenden Registrierungseinträge:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows Defender\Features
TamperProtection = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender
DisableAntiSpyware = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableBehaviorMonitoring = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableOnAccessProtection = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableScanOnRealtimeEnable = 1

Verbreitung

Diese Malware hat keine Verbreitungsroutine.

Backdoor-Routine

Diese Malware hat keine Backdoor-Routine.

Prozessbeendigung

Beendet die folgenden Prozesse, wenn sie im Speicher des betroffenen Systems ausgeführt werden:

• MBSetup.exe
• avg_free_antivirus_setup.exe
• avast_internet_security_setup.exe
• MCAFEE_INSTALLER.exe
• MCPR.exe
• Setup.exe
• kis21.0.1.235de-1G.exe
• bitdefender_online.exe
• NSDownloader.exe
• avast_free_antivirus_setup_online.exe
• avast.exe
• AVG.exe
• McAfee.exe
• AhnLab-V3.exe
• AlibabaSetup.msi
• AviraNoCloudInstaller.exe
• BaiduProtection.exe
• ClamAVInstaller.exe
• CMCSetup.exe
• CybereasonProtection.msi
• DrWebSetup.exe
• ESET-NOD32Installer.exe
• GridinsoftNoCloudSetup.exe
• IkarusProtection.exe
• JiangminInstaller.msi
• K7AntiVirusSetup.exe
• K7GWInstaller.exe
• NANO-AntivirusSetup.exe
• PaloAltoNetworksInstaller.msi
• QuickHealSetup.exe
• SUPERAntiSpywareInstaller.exe
• TACHYONSetup.exe
• TEHTRISInstaller.msi
• TencentProtection.exe
• VBA32Setup.exe
• VirITInstaller.msi
• ViRobotSetup.exe
• WebrootInstaller.exe
• WithSecureSetup.msi
• XcitiumInstaller.exe
• YandexProtectionSetup.exe
• ZillyaInstaller.msi
• ZonerSetup.exe
• AvastMobileInstaller.apk
• TrendMicro-HouseCall.exe
• VIPRESetup.exe
• VaristInstaller.msi
• TrendMicroInstaller.exe
• TrellixFireEyeSetup.exe
• SymantecSetup.exe
• SophosInstaller.exe
• SkyhighSWGSetup.exe
• SentinelOneStaticMLInstaller.exe
• SecureAgeSetup.exe
• SangforEngineZeroInstaller.msi
• RisingSetup.exe
• PandaInstaller.exe
• MaxSecureSetup.exe
• MAXInstaller.exe
• LionicSetup.exe
• KingsoftInstaller.exe
• GDataSetup.exe
• eScanInstaller.exe
• EmsisoftSetup.exe
• ElasticInstaller.exe
• DeepInstinctSetup.exe
• CynetInstaller.msi
• CylanceSetup.exe
• CrowdStrikeFalconSetup.exe
• BkavProInstaller.exe
• BitDefenderThetaSetup.exe
• BitDefenderInstaller.exe
• Antiy-AVLSetup.exe
• ArcabitInstaller.exe
• ALYacSetup.exe
• SystemSettingsAdminFlows.exe

Datendiebstahl

Diese Malware kann keine Daten stehlen.

Andere Details

Es macht Folgendes:

• It checks if the current user has administrator privileges.
• It checks for the presence drivers\etc\hosts in the system.
• It checks for installed security-related services by using the following format:
  • 127.0.0.1 {domain name}
  • 127.0.0.1 www.{domain name}
• It checks for the following domain names:
  • virustotal.com
  • avast.com
  • totalav.com
  • scanguard.com
  • totaladblock.com
  • pcprotect.com
  • mcafee.com
  • bitdefender.com
  • us.norton.com
  • avg.com
  • malwarebytes.com
  • pandasecurity.com
  • avira.com
  • norton.com
  • eset.com
  • zillya.com
  • kaspersky.com
  • usa.kaspersky.com
  • sophos.com
  • home.sophos.com
  • adaware.com
  • bullguard.com
  • clamav.net
  • drweb.com
  • emsisoft.com
  • f-secure.com
  • zonealarm.com
  • trendmicro.com
  • ccleaner.com
  • gdata.de
  • arcabit.com
  • ahnlab.com
  • securelist.com
  • quickheal.com
  • vipre.com
  • cyren.com
  • comodo.com
  • fortinet.com
  • ikarussecurity.com
  • maxsecureantivirus.com
  • baidu.com
  • antiy.net
  • kingsoft.com
  • superantispyware.com
  • spybot.info
  • pcmatic.com
  • hitmanpro.com
  • sophoshome.com
  • defender-pro.com
  • norman.com
  • webroot.com
  • qihoo.com
  • tencent.com
  • baesystems.com
  • carbonblack.com
  • reasonlabs.com
  • lenovo.com
  • cyradar.com
  • intego.com
  • panda.com
  • surfshark.com
  • webroot.com
  • nordvpn.com