1

Has anyone tried seeing what's inside of this malware? It ended up on one of our work machines. I copied the files to a thumb drive before setting the machine up for reimaging. Though the AV software kept saying it was removed, it kept coming back.

I noticed 3 outbound connections. Two were to Amazon AWS servers and one was to a machine in Panama based on the IP.

All the included .bat files are the same as below. I've checked against different encryption types but haven't had any luck figuring out the commands in the file. All of the executable have a 3 character extension. Looked at them in a hex editor and am unable to pull any useful data.

This is more out of curiosity than anything. 

    echo KWvBTeEhoOBvYGBOV0L9i07izYZQZ6eUNvN
echo UHCxEg2gVic
echo FgXcH8LAyBRqqlUil8L
echo EqXkXZQa0
echo 3BPrg
echo ptGFX9BkqRJM50l0ZhOy4FHpc2TYBtayl70
echo FfStAj3XYV5w9u
start "Lnvqgn8kWPwvFipqD8tLpq" "%LOCALAPPDATA%\Gm Ugc\iqgux rez.dcah"
echo f199qjLWdJ6URiTJLa3AC0
echo bF6MorMQoqttAWAMHa
echo Kpme1Fkmm
echo kLShOlr2t
echo sTNvUyM5FjoN89YzL3CFCdi5d6bknL
echo K6n2kL9BxaAY9NlDD8tFg
Improve this question
4
  • 1
    the echos seem to be just random noise, possibly to reduce detection rate. The meat is probably in the iqgux rez.dcah binary.
    – Igor Skochinsky ♦
    Feb 23, 2018 at 13:49
  • other than a hex editor, there away to look inside the binary?
    – RRice
    Feb 24, 2018 at 0:49
  • To actually do proper reverse engineering you'll at a minimum want to open it up in a disassembler and debugger to see what it's doing. IDA still the de-facto standard and has a free variant however it may not work for 64bit binaries. That being said, Rootkit.Fileless.MTGen is a generic detection and can be multiple different kinds of malware with a rootkit component
    – Fewmitz
    Feb 24, 2018 at 21:06
  • @Fewmitz: if this is live malicious code, running it in a debugger without further precautions is actually a pretty bad idea.
    – 0xC0000022L ♦
    May 28, 2018 at 7:59

1 Answer 1

Reset to default
1

the echo statements seem to be just random noise, possibly to reduce antivirus detection rate. The only line which is actually doing something is this one:

start "Lnvqgn8kWPwvFipqD8tLpq" "%LOCALAPPDATA%\Gm Ugc\iqgux rez.dcah"

It starts a new process using a file located in %LOCALAPPDATA%\Gm Ugc\iqgux rez.dcah, so it's probably an executable containing the actual functionality of malware. You will need to analyze it to figure out what it does (e.g. using a disassembler or a decompiler, depending on the file format).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.