Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cacls.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\nrbfurwyf] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\nrbfurwyf] 'ImagePath' = '%WINDIR%\nsyzlnbt\nfqbdtr.exe'
- [<HKLM>\System\CurrentControlSet\Services\PolicyAgent] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\npf] 'ImagePath' = 'system32\drivers\npf.sys'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\NPF] 'Start' = '00000002'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\net.exe' stop "Boundary Meter"
- '%WINDIR%\syswow64\net.exe' stop "TrueSight Meter"
- '%WINDIR%\syswow64\net.exe' stop npf
Modifies file system
Creates the following files
- %WINDIR%\nsyzlnbt\nfqbdtr.exe
- %WINDIR%\fnwtqsuit\bsyvinbet\wpcap.dll
- %WINDIR%\fnwtqsuit\bsyvinbet\packet.dll
- %WINDIR%\fnwtqsuit\bsyvinbet\qqbtssban.exe
- %WINDIR%\temp\udd522f.tmp
- <SYSTEM32>\packet.dll
- <SYSTEM32>\wpcap.dll
- <DRIVERS>\npf.sys
- %ProgramFiles%\winpcap\uninstall.exe
- %ProgramFiles%\winpcap\license
- %WINDIR%\fnwtqsuit\bsyvinbet\pftzrbvfr.exe
- %ProgramFiles%\winpcap\rpcapd.exe
- %WINDIR%\syswow64\wpcap.dll
- %WINDIR%\syswow64\pthreadvc.dll
- %WINDIR%\temp\nsx4715.tmp\nsexec.dll
- %WINDIR%\temp\nsx4715.tmp\system.dll
- %WINDIR%\temp\nsx4715.tmp\final.ini
- %WINDIR%\temp\nsx4715.tmp\options.ini
- %WINDIR%\temp\nsi4705.tmp
- %WINDIR%\fnwtqsuit\bsyvinbet\wpcap.exe
- %WINDIR%\temp\fnwtqsuit\ztsrnqsry.exe
- %WINDIR%\syswow64\packet.dll
- global\npf_{6a52be73-ec8e-4f63-a268-7517a50dcb38}
Deletes the following files
- %WINDIR%\temp\nsx4715.tmp\final.ini
- %WINDIR%\temp\nsx4715.tmp\nsexec.dll
- %WINDIR%\temp\nsx4715.tmp\options.ini
- %WINDIR%\temp\nsx4715.tmp\system.dll
- %WINDIR%\temp\udd522f.tmp
Modifies the HOSTS file.
Moves itself
- from <Full path to file> to %TEMP%\1125171\....\temporaryfile
Network activity
Connects to
- 'bk.####vbnc2e.stream':63145
UDP
- DNS ASK li.####hero2019.club
- DNS ASK bk.####vbnc2e.stream
- DNS ASK rp.####vbnc2e.stream
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'pftzrbvfr.exe'
- ClassName: '' WindowName: 'qqbtssban.exe'
- ClassName: '' WindowName: 'swrpwe.exe'
- ClassName: '' WindowName: 'spoolsrv.exe'
- ClassName: '' WindowName: 'svschost.exe'
- ClassName: '' WindowName: 'scvhost.exe'
- ClassName: '' WindowName: 'wmic.exe'
- ClassName: '' WindowName: 'vfshost.exe'
- ClassName: '' WindowName: 'vimpcsvc.exe'
- ClassName: '' WindowName: 'docmicfg.exe'
- ClassName: '' WindowName: 'schoedcl.exe'
Creates and executes the following
- '%WINDIR%\nsyzlnbt\nfqbdtr.exe'
- '%WINDIR%\fnwtqsuit\bsyvinbet\wpcap.exe' /S
- '%WINDIR%\fnwtqsuit\bsyvinbet\qqbtssban.exe' -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ %WINDIR%\fnwtqsuit\bsyvinbet\Scant.txt
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 5 & Start %WINDIR%\nsyzlnbt\nfqbdtr.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo Y|cacls <DRIVERS>\etc\hosts /T /D users & echo Y|cacls <DRIVERS>\etc\hosts /T /D administrators & echo Y|cacls <DRIVERS>\etc\hosts /T /D SYSTEM' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' ipsec static add policy name=Bastards description=FuckingBastards' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' ipsec static add filteraction name=BastardsList action=block' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\fnwtqsuit\bsyvinbet\wpcap.exe /S' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "Boundary Meter"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "TrueSight Meter"' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop npf' (with hidden window)
- '%WINDIR%\syswow64\net.exe' start npf' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net start npf' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\fnwtqsuit\bsyvinbet\qqbtssban.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ %WINDIR%\fnwtqsuit\bsyvinbet\Scant.txt' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 5 & Start %WINDIR%\nsyzlnbt\nfqbdtr.exe
- '%WINDIR%\syswow64\net1.exe' start npf
- '%WINDIR%\syswow64\net.exe' start npf
- '%WINDIR%\syswow64\net1.exe' stop npf
- '%WINDIR%\syswow64\net1.exe' stop "TrueSight Meter"
- '%WINDIR%\syswow64\net1.exe' stop "Boundary Meter"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\fnwtqsuit\bsyvinbet\wpcap.exe /S
- '%WINDIR%\syswow64\cmd.exe' /c net start npf
- '%WINDIR%\syswow64\netsh.exe' ipsec static add filteraction name=BastardsList action=block
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /T /D SYSTEM
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /T /D administrators
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /T /D users
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo Y"
- '%WINDIR%\syswow64\cmd.exe' /c echo Y|cacls <DRIVERS>\etc\hosts /T /D users & echo Y|cacls <DRIVERS>\etc\hosts /T /D administrators & echo Y|cacls <DRIVERS>\etc\hosts /T /D SYSTEM
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 5
- '%WINDIR%\syswow64\netsh.exe' ipsec static add policy name=Bastards description=FuckingBastards
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\fnwtqsuit\bsyvinbet\qqbtssban.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ %WINDIR%\fnwtqsuit\bsyvinbet\Scant.txt
