Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Adobe QuikInstall' = '%APPDATA%\Adobe\Adobe QuikInstall.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, C:\Adobe\svhost.exe'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, C:\Adobe\svhost.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\system.lnk
- <SYSTEM32>\tasks\54e11462d8e985d7d984212a5465906f
- <SYSTEM32>\tasks\p3zqqc5e
- <SYSTEM32>\tasks\nokqtpmn
- <SYSTEM32>\tasks\xld5rpf3
- <SYSTEM32>\tasks\5fllh0ew
- <SYSTEM32>\tasks\s5npgt4m
- <SYSTEM32>\tasks\fzz04uf3
- <SYSTEM32>\tasks\ebnbexms
- <SYSTEM32>\tasks\123meh4d
- <SYSTEM32>\tasks\cvtkywzf
Modifies file system
Creates the following files
- C:\adobe\ad5mou5coyrluxvakuya.exe
- %TEMP%\rese2f0.tmp
- C:\media\csce2ef.tmp
- %TEMP%\nn4btz5o.out
- %TEMP%\nn4btz5o.cmdline
- %TEMP%\nn4btz5o.0.cs
- %TEMP%\ciebhvld.out
- %TEMP%\ciebhvld.cmdline
- %TEMP%\ciebhvld.0.cs
- %TEMP%\0qoziudu.out
- %TEMP%\0qoziudu.cmdline
- %TEMP%\0qoziudu.0.cs
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\conhost.exe
- %TEMP%\resbf7a.tmp
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\cscbf79.tmp
- %TEMP%\nrlwzj3y.out
- %TEMP%\nrlwzj3y.cmdline
- %TEMP%\nrlwzj3y.0.cs
- %TEMP%\resb568.tmp
- %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\explorer.exe
- C:\media\svhost.exe
- %TEMP%\2dj0hzrc.0.cs
- %TEMP%\s1uhxhqu.0.cs
- C:\users\all users\favorites\yourphone.exe
- %TEMP%\res926.tmp
- C:\users\all users\favorites\csc925.tmp
- %TEMP%\e2lnv5rj.out
- %TEMP%\e2lnv5rj.cmdline
- %TEMP%\e2lnv5rj.0.cs
- %ProgramFiles%\a2upd\iexplore.exe
- %ProgramFiles%\a2upd\csc126.tmp
- %TEMP%\dclib\rs2300f068121707def35df4f7b5d2bc8a016bd37f.dclib
- %TEMP%\v0j02alj.out
- %TEMP%\v0j02alj.cmdline
- %TEMP%\v0j02alj.0.cs
- %PROGRAMDATA%\microsoft toolkit\lsass.exe
- %TEMP%\resef54.tmp
- %PROGRAMDATA%\microsoft toolkit\cscef44.tmp
- %TEMP%\2dj0hzrc.out
- %TEMP%\2dj0hzrc.cmdline
- %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\cscb567.tmp
- %TEMP%\13fceao5.out
- %TEMP%\13fceao5.cmdline
- C:\adobe\svhost.exe
- C:\adobe\vmcheck32.dll
- C:\adobe\d8k7v537wgtkcymm5ujcnnncnirv1r.bat
- C:\adobe\watchdog.data
- C:\adobe\starter.exe
- C:\adobe\dogs\yourphone.exe
- C:\adobe\dogs\securityhealthservice.exe
- C:\adobe\dogs\runtime broker.exe
- C:\adobe\dogs\adobe quikinstall.exe
- C:\adobe\mos
- C:\adobe\msg.vbs
- C:\adobe\dclib\rs2300f068121707def35df4f7b5d2bc8a016bd37f.dclib
- C:\adobe\dclib\antiwindowsdefender.dclib
- C:\adobe\dclib\al6cf54c5afe698333513f91b6a461a8fe412e5694.dclib
- C:\adobe\o6xorrr8wboltbhdvorermi4oa88ui.bat
- C:\adobe\fgiohozsapd0xzzyfhiy2mkchy9cmt.vbs
- C:\adobe\system.lnk
- %APPDATA%\notepad\media.zip
- C:\adobe\system.vbe
- %APPDATA%\obsidium\runtime broker.exe
- %TEMP%\13fceao5.0.cs
- %APPDATA%\vortex\securityhealthservice.exe
- C:\documents and settings\iexplore.exe
- %TEMP%\res906b.tmp
- C:\documents and settings\csc905b.tmp
- %TEMP%\w5qca40b.out
- %TEMP%\w5qca40b.cmdline
- %TEMP%\w5qca40b.0.cs
- C:\adobe\dclib\naz4kdb2\vmcheck32.dll
- %TEMP%\res127.tmp
- %TEMP%\s1uhxhqu.cmdline
- %TEMP%\dclib\antiwindowsdefender.dclib
- %TEMP%\dclib\al6cf54c5afe698333513f91b6a461a8fe412e5694.dclib
- %APPDATA%\notepad\system.vbe
- %APPDATA%\adobe\adobe quikinstall.exe
- %APPDATA%\sun\watchdog.data
- %APPDATA%\vortex\watchdog.data
- %APPDATA%\obsidium\watchdog.data
- %APPDATA%\sun\yourphone.exe
- C:\adobe\dclib\naz4kdb2\svhost.exe
- %TEMP%\s1uhxhqu.out
Deletes the following files
- %TEMP%\res906b.tmp
- %TEMP%\nn4btz5o.0.cs
- %TEMP%\nn4btz5o.out
- %TEMP%\nn4btz5o.cmdline
- %TEMP%\resef54.tmp
- %PROGRAMDATA%\microsoft toolkit\cscef44.tmp
- %TEMP%\2dj0hzrc.0.cs
- %TEMP%\2dj0hzrc.out
- %TEMP%\2dj0hzrc.cmdline
- %TEMP%\res127.tmp
- %ProgramFiles%\a2upd\csc126.tmp
- %TEMP%\v0j02alj.out
- %TEMP%\v0j02alj.cmdline
- %TEMP%\v0j02alj.0.cs
- %TEMP%\res926.tmp
- C:\users\all users\favorites\csc925.tmp
- %TEMP%\e2lnv5rj.cmdline
- %TEMP%\e2lnv5rj.0.cs
- %TEMP%\e2lnv5rj.out
- %TEMP%\s1uhxhqu.0.cs
- C:\media\csce2ef.tmp
- %TEMP%\s1uhxhqu.cmdline
- %TEMP%\rese2f0.tmp
- %TEMP%\ciebhvld.cmdline
- C:\documents and settings\csc905b.tmp
- %TEMP%\w5qca40b.cmdline
- %TEMP%\w5qca40b.0.cs
- %TEMP%\w5qca40b.out
- %TEMP%\resb568.tmp
- %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\cscb567.tmp
- %TEMP%\13fceao5.out
- %TEMP%\13fceao5.0.cs
- %TEMP%\13fceao5.cmdline
- %TEMP%\resbf7a.tmp
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\cscbf79.tmp
- %TEMP%\nrlwzj3y.out
- %TEMP%\nrlwzj3y.cmdline
- %TEMP%\nrlwzj3y.0.cs
- C:\adobe\dogs\yourphone.exe
- %TEMP%\0qoziudu.cmdline
- %TEMP%\0qoziudu.0.cs
- %TEMP%\0qoziudu.out
- %TEMP%\ciebhvld.0.cs
- %TEMP%\ciebhvld.out
- %TEMP%\s1uhxhqu.out
Network activity
TCP
HTTP GET requests
- http://co####2.tmweb.ru/q9nh8bj91aduwku7727vek5mgfrscy4omx3f6noplmrlupugatwxxcjpcw93o1zvib4r92tf6q8mbwxl/y5dv41/d3e5506c5e61837f78254892228246abddcbf977.php?1c################################
- http://co####2.tmweb.ru/q9nh8bj91aduwku7727vek5mgfrscy4omx3f6noplmrlupugatwxxcjpcw93o1zvib4r92tf6q8mbwxl/y5dv41/d3e5506c5e61837f78254892228246abddcbf977.php?86##################################...
- http://co####2.tmweb.ru/q9nh8bj91aduwku7727vek5mgfrscy4omx3f6noplmrlupugatwxxcjpcw93o1zvib4r92tf6q8mbwxl/y5dv41/8fx6fokk8mes0u2llfcmtv4l7zhis9gp0pabxmlyxz0hypz139nrnhrdxw7z5rmi46conu0/03f02b0fc...
- http://ip##fo.io/ip
UDP
- DNS ASK co####2.tmweb.ru
- DNS ASK ip##fo.io
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "C:\Adobe\fGiOHozSaPd0xZZyFhiY2mkChy9cMt.vbs"
- 'C:\media\svhost.exe'
- '%PROGRAMDATA%\microsoft toolkit\lsass.exe'
- '%APPDATA%\sun\yourphone.exe'
- 'C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\conhost.exe'
- '%APPDATA%\vortex\securityhealthservice.exe'
- '%ProgramFiles%\a2upd\iexplore.exe'
- 'C:\users\all users\favorites\yourphone.exe'
- '%ProgramFiles(x86)%\adobe\acrobat reader dc\esl\explorer.exe'
- 'C:\adobe\starter.exe'
- '%WINDIR%\syswow64\wscript.exe' "C:\Adobe\msg.vbs"
- '%WINDIR%\syswow64\wscript.exe' "C:\Adobe\System.vbe"
- 'C:\adobe\ad5mou5coyrluxvakuya.exe' -p614b29475cdf4a942d86c0af1ae4ffd9cadd2f88
- 'C:\adobe\svhost.exe'
- 'C:\documents and settings\iexplore.exe'
- '%APPDATA%\adobe\adobe quikinstall.exe'
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ciebhvld.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\2dj0hzrc.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES926.tmp" "c:\Users\All Users\Favorites\CSC925.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\e2lnv5rj.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\nn4btz5o.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\0qoziudu.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES127.tmp" "%ProgramFiles%\a2upd\CSC126.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE2F0.tmp" "c:\Media\CSCE2EF.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB568.tmp" "%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Esl\CSCB567.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\v0j02alj.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEF54.tmp" "%PROGRAMDATA%\Microsoft Toolkit\CSCEF44.tmp"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C C:/Media/fontreview.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C %APPDATA%\Sun\YourPhone.exe' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\s1uhxhqu.cmdline"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\Adobe\O6XorRR8WBolTbHDVORerMi4Oa88UI.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C %APPDATA%\Obsidium\Runtime Broker.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C %APPDATA%\Vortex\SecurityHealthService.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\Adobe\D8k7v537wGTKCymM5UJcnnnCNIrv1r.bat" "' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBF7A.tmp" "c:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\CSCBF79.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\w5qca40b.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES906B.tmp" "c:\Documents and Settings\CSC905B.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\13fceao5.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\nrlwzj3y.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1829.tmp" "c:\Documents and Settings\CSC1809.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\Adobe\O6XorRR8WBolTbHDVORerMi4Oa88UI.bat" "
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES926.tmp" "c:\Users\All Users\Favorites\CSC925.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\e2lnv5rj.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES127.tmp" "%ProgramFiles%\a2upd\CSC126.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\v0j02alj.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEF54.tmp" "%PROGRAMDATA%\Microsoft Toolkit\CSCEF44.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\2dj0hzrc.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE2F0.tmp" "c:\Media\CSCE2EF.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\nn4btz5o.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ciebhvld.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\0qoziudu.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\s1uhxhqu.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBF7A.tmp" "c:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\CSCBF79.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB568.tmp" "%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Esl\CSCB567.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\13fceao5.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES906B.tmp" "c:\Documents and Settings\CSC905B.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\w5qca40b.cmdline"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-MpPreference -verbose
- '%WINDIR%\syswow64\cmd.exe' /C C:/Media/fontreview.exe
- '%WINDIR%\syswow64\cmd.exe' /C %APPDATA%\Sun\YourPhone.exe
- '%WINDIR%\syswow64\cmd.exe' /C %APPDATA%\Vortex\SecurityHealthService.exe
- '%WINDIR%\syswow64\cmd.exe' /C %APPDATA%\Obsidium\Runtime Broker.exe
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\Adobe\D8k7v537wGTKCymM5UJcnnnCNIrv1r.bat" "
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\nrlwzj3y.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1829.tmp" "c:\Documents and Settings\CSC1809.tmp"
