Spoof Call and Spoof SMS set any caller ◆ Private Crypter - Unique Private Stubs ◆ 📢 Advertise on HF Today ◆ [#1] PURE RAT v4 // BEST HVNC RAT ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Whitehat • Blue Team • Defensive Security Malware, Rat, and Virus Removal › [Infected] Weird bat file and unknown extension file in Local folder

New Reply 
Infected 

Weird bat file and unknown extension file in Local folder
JackYYY
JackYYY Offline
[n00b@HF:]
*
Registered
Posts:
3
Threads:
1
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Nov 21, 2016 03:02 AM (This post was last modified: Nov 21, 2016 03:08 AM by JackYYY.)
Hello.

I have two weird files in my Appdata/Local folder and it keeps recreating itself every 5 seconds. Deleting it doesn't work, obviously, it keeps reappearing, with a different "key" each time. It's a .bat file and another file with a weird extension.

"5047f1f8.bat" :
" start "qjzAHi236kyahl7GoM" "%LOCALAPPDATA%\21aaacf5\d127c64c.a45bc5356" "
"qjzAHi236kyahl7GoM" is the key that changes each time the file reappears.

The second file is "d127c64c.a45bc5356". Its size keeps changing and I have no clue on what it may be.

I tried many scans, including on those specific files, try running them in sandboxes, and the only thing that happens is an error saying that it's an unknown extension. For some reasons my computer can run it without saying me that the extension is unknown.

I can upload it (the second file) but won't post the link directly there since there may be some personal info in it.

EDIT : By the way, the process accesing this file is the "System" itself. It may just be a system file but it's really weird. i.gyazo*com/e243043e81ba9c1e79b2f6b6a3673d15.png
JoshuTee
JoshuTee Offline
[closed@HF:]
Posts:
1,521
Threads:
55
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Nov 21, 2016 03:29 AM
The bat file isn't creating itself, it's another piece of malware, we're going to remove that.
Please run Adwcleaner and clean all detections.
JackYYY
JackYYY Offline
[n00b@HF:]
*
Registered
Posts:
3
Threads:
1
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Nov 21, 2016 07:39 PM
(Nov 21, 2016 03:29 AM)JoshuTee Wrote:  The bat file isn't creating itself, it's another piece of malware, we're going to remove that.
Please run Adwcleaner and clean all detections.

Ok, thanks 😁 ! But it didn't solve the problem though. 😖
R^ptor
R^ptor Offline
Your favorite
***
HF l33t
Posts:
588
Threads:
62
Credibility:
000
Popularity:
82
βytes:
β 21.26
Game XP:
0
Nov 22, 2016 12:43 AM
Adware Cleaner and Malbytes should fix the problem. Weird question... Can you view the code of the batch file? Curious what it has...
JackYYY
JackYYY Offline
[n00b@HF:]
*
Registered
Posts:
3
Threads:
1
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Nov 22, 2016 12:54 AM
(Nov 22, 2016 12:43 AM)R^ptor Wrote:  Adware Cleaner and Malbytes should fix the problem. Weird question... Can you view the code of the batch file? Curious what it has...

Not at all, I can send it to you by PM if you're able to analyze it though.
JoshuTee
JoshuTee Offline
[closed@HF:]
Posts:
1,521
Threads:
55
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Nov 22, 2016 04:48 AM
(Nov 22, 2016 12:54 AM)JackYYY Wrote:  Not at all, I can send it to you by PM if you're able to analyze it though.

Could you also pm it to me please?
Aura
Aura Offline
[g0d@HF:]
******
HF Ub3r
Posts:
33,920
Threads:
533
Credibility:
000
Popularity:
655
βytes:
β 568.2
Game XP:
11
Nov 22, 2016 05:43 PM
Pretty sure AdwCleaner won't do jackshit about your infection because it isn't an Adware, PUP, Browser Hijacker, etc.
Fiat justitia ruat cælum

My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by SpacepanzerFeb 21, 2023 11:38 AM 6 205 Feb 21, 2023 11:38 AM
Last Post: Spacepanzer
by iLogic™Dec 1, 2017 08:40 AM 3 238 Dec 1, 2017 08:40 AM
Last Post: Avicti3
[Check-Up] by iLogic™Aug 12, 2016 12:56 PM 5 248 Aug 12, 2016 12:56 PM
Last Post: iLogic™