A forum for reverse engineering, OS internals and malware analysis
nullptr wrote:Another ZeroAccess MD5: E6823F932C2B40D2025D78BB78D64458Creates a folder %windir%\$NtUninstallKB494$, which actually sym link (i. e. contains $SYMBOLIC_LINK attribute).
+ decrypted (as far as Diablo2002 loader) + other bits.
rkhunter wrote:Creates a folder %windir%\$NtUninstallKB494$, which actually sym link (i. e. contains $SYMBOLIC_LINK attribute).Just a note: The name of $NtUninstallKB494$ changes (depending on system volume date and time). The second stream of the above mentioned service contains an EXE. When a process tries to open that stream, it it killed and its EXE is deleted.
But I noticed a new behavior, it creates key for start with image path - \systemroot\4151568013:1914276872.exe.
Main $DATA-stream in file 4151568013 is empty, but 2-nd stream stores it driver.
Ladik wrote:I made a mistake when wrote about driver, it's exe file and not the driver.rkhunter wrote:Creates a folder %windir%\$NtUninstallKB494$, which actually sym link (i. e. contains $SYMBOLIC_LINK attribute).Just a note: The name of $NtUninstallKB494$ changes (depending on system volume date and time). The second stream of the above mentioned service contains an EXE. When a process tries to open that stream, it it killed and its EXE is deleted.
But I noticed a new behavior, it creates key for start with image path - \systemroot\4151568013:1914276872.exe.
Main $DATA-stream in file 4151568013 is empty, but 2-nd stream stores it driver.
I'm Luke Skywalker. I'm here to rescue you. Help me, Obi-Wan Kenobi; you're my only hope.Trap process and trap registry key are still in place.
