Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\system
- <SYSTEM32>\tasks\dns
- <SYSTEM32>\tasks\skycmd
Malicious functions
Downloads and executes
- http://sb####g.f3322.net/cget.exe as cget.exe
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' -f /im svshost.exe
- '%WINDIR%\syswow64\taskkill.exe' -f /im svshosb.exe
Modifies file system
Creates the following files
- %WINDIR%\debug\system\skycmd.bat
- %WINDIR%\debug\system\start.bat
- %WINDIR%\debug\system\start2.bat
- %WINDIR%\debug\system\down.bat
- %WINDIR%\debug\system\hosts
- %WINDIR%\debug\system\install3.bat
- %WINDIR%\debug\system\open.bat
- %WINDIR%\debug\system\qc.bat
- %PROGRAMDATA%\microsoft\test\down.bat
- %PROGRAMDATA%\microsoft\test\open.bat
- %PROGRAMDATA%\microsoft\test\hosts
- nul
Sets the 'hidden' attribute to the following files
- %PROGRAMDATA%\microsoft\test\down.bat
- %PROGRAMDATA%\microsoft\test\hosts
- %PROGRAMDATA%\microsoft\test\open.bat
Network activity
UDP
- DNS ASK sb####g.f3322.net
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\debug\SYSTEM\install3.bat" h"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\debug\SYSTEM\start.bat" "
- '%WINDIR%\syswow64\netsh.exe' ipsec static add filteraction name=deny action=block
- '%WINDIR%\syswow64\netsh.exe' ipsec static add filteraction name=Allow action=permit
- '%WINDIR%\syswow64\netsh.exe' ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=445
- '%WINDIR%\syswow64\netsh.exe' ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=139
- '%WINDIR%\syswow64\netsh.exe' ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=138
- '%WINDIR%\syswow64\netsh.exe' ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=137
- '%WINDIR%\syswow64\netsh.exe' ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=135
- '%WINDIR%\syswow64\netsh.exe' ipsec static add filterlist name=denylist
- '%WINDIR%\syswow64\netsh.exe' ipsec static add filterlist name=Allowlist
- '%WINDIR%\syswow64\netsh.exe' ipsec static add policy name=win
- '%WINDIR%\syswow64\sc.exe' QUERY FTPUPDATE
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\debug\SYSTEM\install3.bat" h"
- '%WINDIR%\syswow64\mshta.exe' vbscript:createobject("wscript.shell").run("""install3.bat"" h",0)(window.close)
- '%WINDIR%\syswow64\attrib.exe' +S +H %WINDIR%\debug\SYSTEM
- '%WINDIR%\syswow64\cmd.exe' /K start2.bat
- '%WINDIR%\syswow64\attrib.exe' +S +H %PROGRAMDATA%\Microsoft\test\open.bat
- '%WINDIR%\syswow64\attrib.exe' +S +H %PROGRAMDATA%\Microsoft\test\down.bat
- '%WINDIR%\syswow64\attrib.exe' +S +H %WINDIR%\Tasks\hook
- '%WINDIR%\syswow64\attrib.exe' +S +H %PROGRAMDATA%\Microsoft\test\*
- '%WINDIR%\syswow64\attrib.exe' +S +H %PROGRAMDATA%\Microsoft\test
- '%WINDIR%\syswow64\schtasks.exe' /F /create /ru system /sc HOURLY /mo 23 /tn skycmd /tr %PROGRAMDATA%\Microsoft\test\skycmd.bat
- '%WINDIR%\syswow64\schtasks.exe' /F /create /ru system /sc HOURLY /mo 1 /tn DNS /tr %PROGRAMDATA%\Microsoft\test\open.bat
- '%WINDIR%\syswow64\schtasks.exe' /F /create /ru system /sc HOURLY /mo 12 /tn SYSTEM /tr %PROGRAMDATA%\Microsoft\test\down.bat
- '%WINDIR%\syswow64\attrib.exe' -S -H %WINDIR%\debug\SYSTEM\*
- '%WINDIR%\syswow64\attrib.exe' -S -H %PROGRAMDATA%\Microsoft\test\*
- '%WINDIR%\syswow64\netsh.exe' interface ip set dns ▒╛╡╪┴Вј╜╙3 static 114.114.114.114
- '%WINDIR%\syswow64\netsh.exe' interface ip set dns ▒╛╡╪┴Вј╜╙2 static 114.114.114.114
- '%WINDIR%\syswow64\netsh.exe' interface ip set dns ▒╛╡╪┴Вј╜╙1 static 114.114.114.114
- '%WINDIR%\syswow64\netsh.exe' interface ip set dns ▒╛╡╪┴Вј╜╙ static 114.114.114.114
- '%WINDIR%\syswow64\netsh.exe' ipsec static add rule name=deny1 policy=win filterlist=denylist filteraction=deny
- '%WINDIR%\syswow64\netsh.exe' ipsec static set policy name=win assign=y
