Any #PowerShell experts able to tell me what this does? http://pastebin.com/raw/2cCBBAQA . Executed by Nemucod ransomware from registry using JS.
-
-
Replying to @BleepinComputer
@Techhelplistcom@JAMESWT_MHT@DanielGallagher @DanielRufde@demonslay335 @dvk01uk@malekal_morte@nyxbone@fwosar@spontiroli@bartblaze1 reply 0 retweets 0 likes -
Replying to @BleepinComputer
@BleepinComputer do you jave JS sample? if nemucode run ransomware maybe is the encrypt key .... but without JS sample i not know1 reply 0 retweets 1 like -
Replying to @JAMESWT_MHT
@JAMESWT_MHT Sample: https://www.virustotal.com/en/file/a10750bfbafad2a7b2a1a65d976cd86acda8680ab5a86496092a9b502565d61f/analysis/ …. According to@fwosar and http://www.symantec.com/connect/blogs/kovter-malware-learns-poweliks-persistent-fileless-registry-update … it is Kovter1 reply 1 retweet 3 likes
@BleepinComputer @JAMESWT_MHT @fwosar Indeed Kovter. See also: http://blog.airbuscybersecurity.com/post/2016/03/FILELESS-MALWARE-%E2%80%93-A-BEHAVIOURAL-ANALYSIS-OF-KOVTER-PERSISTENCE …
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.