Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 912461" data-attributes="member: 32260">This BAT is&nbsp; CXK-NMSL ver. 3.2 and it is almost identical to the BAT used by the malware:[URL unfurl=&quot;true&quot;]https://app.any.run/tasks/48d85578-5855-40b0-94f3-ce0bf570300c/[/URL]which is CXK-NMSL ver. 3.3.In the ver. 3.3 the BAT contains an additional binary added at the end and some code related to it (this binary is not malicious).The first tenths of lines of CXK-NMSL V3.2.bat are a simple fake-ransomware code based on Certutil encoding abilities. Next, there are some binaries encoded by Certutil. These binaries can be easily extracted by using the code from this BAT (the code is not obfuscated). These binaries are probably not malicious (although some of them are flagged on VirusTotal).Here are the links about some created files:CXK-NMSL-README.txt (ransomware note in Chinese simplified)CXK-NMSL-DATA.exe[URL unfurl=&quot;true&quot;]https://www.virustotal.com/gui/file/a0ca3db738e904ee16eb1ab0ada30d0a4be5f89da68211d9855ad749de5aae20/detection[/URL]krnln.fnr[URL unfurl=&quot;true&quot;]https://www.virustotal.com/gui/file/4bed8a6e4e1548fddee40927b438132b47ef2aca6e9beb06b89fcf7714726310/detection[/URL]_ŻTŽ+ä_â_ÜTź_é+ö.mp3 (mp3 music file which is played in the end)x.js&nbsp; (creates z.zip = compressed wallpaper)[URL unfurl=&quot;true&quot;]https://www.virustotal.com/gui/file/aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596/details[/URL]z.zip&nbsp; (contains compressed wallpaper.jpg which replaces the wallpaper on the Desktop)[SPOILER][ATTACH=full]248505[/ATTACH][/SPOILER]The malware changes the start page in Internet Explorer to the webpage that displays a videoclip:reg add &quot;HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main&quot; /v &quot;Start Page&quot; /d &quot; hxxps://www.bilibili.com/video/av61335515/ &quot; /freg add &quot;HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main&quot; /v &quot;Default_Page_URL&quot; /d &quot; hxxps://www.bilibili.com/video/av61335515/ &quot; /fPost edited.</blockquote>

[QUOTE="Andy Ful, post: 912461, member: 32260"] This BAT is CXK-NMSL ver. 3.2 and it is almost identical to the BAT used by the malware: [URL unfurl="true"]https://app.any.run/tasks/48d85578-5855-40b0-94f3-ce0bf570300c/[/URL] which is CXK-NMSL ver. 3.3. In the ver. 3.3 the BAT contains an additional binary added at the end and some code related to it (this binary is not malicious). The first tenths of lines of CXK-NMSL V3.2.bat are a simple fake-ransomware code based on Certutil encoding abilities. Next, there are some binaries encoded by Certutil. These binaries can be easily extracted by using the code from this BAT (the code is not obfuscated). These binaries are probably not malicious (although some of them are flagged on VirusTotal). Here are the links about some created files: [B]CXK-NMSL-README.txt[/B] (ransomware note in Chinese simplified) [B]CXK-NMSL-DATA.exe[/B] [URL unfurl="true"]https://www.virustotal.com/gui/file/a0ca3db738e904ee16eb1ab0ada30d0a4be5f89da68211d9855ad749de5aae20/detection[/URL] [B]krnln.fnr[/B] [URL unfurl="true"]https://www.virustotal.com/gui/file/4bed8a6e4e1548fddee40927b438132b47ef2aca6e9beb06b89fcf7714726310/detection[/URL] [B]_ŻTŽ+ä_â_ÜTź_é+ö.mp3 [/B] (mp3 music file which is played in the end) [B]x.js [/B](creates z.zip = compressed wallpaper) [URL unfurl="true"]https://www.virustotal.com/gui/file/aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596/details[/URL] [B]z.zip[/B] (contains compressed wallpaper.jpg which replaces the wallpaper on the Desktop) [SPOILER][ATTACH type="full" alt="wallpaper.jpg"]248505[/ATTACH][/SPOILER] The malware changes the start page in Internet Explorer to the webpage that displays a videoclip: reg add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d " hxxps://www.bilibili.com/video/av61335515/ " /f reg add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Default_Page_URL" /d " hxxps://www.bilibili.com/video/av61335515/ " /f Post edited. [/QUOTE]

Verification