Has anyone tried seeing what's inside of this malware? It ended up on one of our work machines. I copied the files to a thumb drive before setting the machine up for reimaging. Though the AV software kept saying it was removed, it kept coming back.
I noticed 3 outbound connections. Two were to Amazon AWS servers and one was to a machine in Panama based on the IP.
All the included .bat files are the same as below. I've checked against different encryption types but haven't had any luck figuring out the commands in the file. All of the executable have a 3 character extension. Looked at them in a hex editor and am unable to pull any useful data.
This is more out of curiosity than anything.
echo KWvBTeEhoOBvYGBOV0L9i07izYZQZ6eUNvN echo UHCxEg2gVic echo FgXcH8LAyBRqqlUil8L echo EqXkXZQa0 echo 3BPrg echo ptGFX9BkqRJM50l0ZhOy4FHpc2TYBtayl70 echo FfStAj3XYV5w9u start "Lnvqgn8kWPwvFipqD8tLpq" "%LOCALAPPDATA%\Gm Ugc\iqgux rez.dcah" echo f199qjLWdJ6URiTJLa3AC0 echo bF6MorMQoqttAWAMHa echo Kpme1Fkmm echo kLShOlr2t echo sTNvUyM5FjoN89YzL3CFCdi5d6bknL echo K6n2kL9BxaAY9NlDD8tFg