Jump to content

Warning about "https://list-cloud.com"


Recommended Posts

Creation of eventvwr files, gave me a quick indication of when I had a corrupted config registry hive... systeminfo confirms the eventvwr dates match...

Edited by koolholio
Link to post
Share on other sites

Did you perform a Win 10 1809 upgrade prior to it being pulled from the update servers?

-EDIT- Also a Win 10 reset install will change the installation date. Also I found out that a reset install doesn't touch anything in the AppData directories. I found that one out after I ran SFC after a Win 10 reset.

Edited by itman
Link to post
Share on other sites
1 minute ago, itman said:

Did you perform a Win 10 1809 upgrade prior to it being pulled from the update servers?

We're talking about events that apparently took place between 11/04/2018 (file date of the malware) and 05/2018... (OS Install month)... this is almost dating back to the Creators update... Haven't even touched the 1809 update! (for it's delete bug...)

Link to post
Share on other sites

I finally found another posting related to this on the Malwarebytes forum. Activity is almost an exact match posted here to date. It is most definitely Bitcoin miner related.

OP posted it on the MBAM forum on 8/27/2018. As such, it is highly unlikely it was related to the recent Task Manager vulnerability. But who knows? The pen tester who found it could have been selling the vulnerability on the dark web sometime before deciding to get some "glory" by publicly posting it. Or as he discovered it, so did others.

Most interesting, it appears the MBAM poster was using Norton which detected the bitcoin mining activity.

In any case at this point, I don't see a 100% positive correlation between the Task Scheduler vulnerability and this bitcoin miner.

https://forums.malwarebytes.com/topic/235808-system-infected-bitcoinminer-activity-7-and-9/

Link to post
Share on other sites
On 10/27/2018 at 9:01 PM, itman said:

In any case at this point, I don't see a 100% positive correlation between the Task Scheduler vulnerability and this bitcoin miner.

This is where the codebase usually comes into detection: it's detected as a software bundler malware family: Unwaders.C  ... occamy.C for the appleversions.dll, and it goes by a few other names... We'll have to wait and see I guess!

Edited by koolholio
Link to post
Share on other sites
4 hours ago, riang23 said:

my problem is gone after I uninstalled pirat*d game.

Easiest way to get infected is to install cracked/pirated software. Amazing how so few realize this.

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...