Python.AVKill.1

sha1:

• 2dd31bf4813dc0e273fa5210c442d68876002f28

Description

Malicious executable for OS Windows, written in Python, compiled with PyInstaller and obfuscated with BlankOBF v.2. It is dropped by Python.Muldrop.39 (fd7eee537605618826ed7dd236948964faa2252f) and saved in C:\ProgramData\setup.exe.

Operating routine

1. Creates a mutex Global\jokerdnr on startup

2. Attempts to run with administrator privileges

3. Disables Windows notifications

4. Adds all disks to the Windows Defender exclusions

5. Disables the UAC warning when running executables with administrator privileges

   "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'ConsentPromptBehaviorAdmin' -Value 0"

6. a) Adds all installed software packages (*.msix, *.appx) to the deprovisioned list

   $store = \'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\AppxAllUserStore\'
   
   $appxpackage = Get-AppxPackage -AllUsers
   
   $PackageFamilyName = ($appxpackage | Where-Object { $_.Name -eq $appx.DisplayName }).PackageFamilyName
   
   New-Item -Path "$store\\Deprovisioned\\$PackageFamilyName" -Force | Out-Null

   b) Adds the software packages to the EndOfLife list, that prevents them from being installed. Sets the flag that the software packages can be removed

   dism /online /set-nonremovableapppolicy /packagefamily:$($appx.PackageFamilyName) /nonremovable:0 | Out-Null

   c) Prevents these software packages from being reinstalled after Windows is updated

7. Disables Windows Restore

8. Deletes files required by Windows Restore