Jump to content

Warning about "https://list-cloud.com"


Recommended Posts

  • Replies 110
  • Created
  • Last Reply

Top Posters In This Topic

Did you perform a Win 10 1809 upgrade prior to it being pulled from the update servers?

-EDIT- Also a Win 10 reset install will change the installation date. Also I found out that a reset install doesn't touch anything in the AppData directories. I found that one out after I ran SFC after a Win 10 reset.

Edited by itman
Link to post
Share on other sites
1 minute ago, itman said:

Did you perform a Win 10 1809 upgrade prior to it being pulled from the update servers?

We're talking about events that apparently took place between 11/04/2018 (file date of the malware) and 05/2018... (OS Install month)... this is almost dating back to the Creators update... Haven't even touched the 1809 update! (for it's delete bug...)

Link to post
Share on other sites

I finally found another posting related to this on the Malwarebytes forum. Activity is almost an exact match posted here to date. It is most definitely Bitcoin miner related.

OP posted it on the MBAM forum on 8/27/2018. As such, it is highly unlikely it was related to the recent Task Manager vulnerability. But who knows? The pen tester who found it could have been selling the vulnerability on the dark web sometime before deciding to get some "glory" by publicly posting it. Or as he discovered it, so did others.

Most interesting, it appears the MBAM poster was using Norton which detected the bitcoin mining activity.

In any case at this point, I don't see a 100% positive correlation between the Task Scheduler vulnerability and this bitcoin miner.

https://forums.malwarebytes.com/topic/235808-system-infected-bitcoinminer-activity-7-and-9/

Link to post
Share on other sites
On 10/27/2018 at 9:01 PM, itman said:

In any case at this point, I don't see a 100% positive correlation between the Task Scheduler vulnerability and this bitcoin miner.

This is where the codebase usually comes into detection: it's detected as a software bundler malware family: Unwaders.C  ... occamy.C for the appleversions.dll, and it goes by a few other names... We'll have to wait and see I guess!

Edited by koolholio
Link to post
Share on other sites
4 hours ago, riang23 said:

my problem is gone after I uninstalled pirat*d game.

Easiest way to get infected is to install cracked/pirated software. Amazing how so few realize this.

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...