Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'SysHelper' = '"%LOCALAPPDATA%\78ce57ff-4713-4a19-844d-fa756e2129b7\49FA.exe" --AutoStart'
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 1f24aa65a9795ced
- <SYSTEM32>\tasks\time trigger task
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %APPDATA%\thwubui
- %APPDATA%\bwcerrg
- %TEMP%\49fa.exe
- %TEMP%\51b8.exe
- %TEMP%\7aeb.exe
- %TEMP%\kvsekvtmjkzriyh.data
- %TEMP%\827b.dll
- %LOCALAPPDATA%\78ce57ff-4713-4a19-844d-fa756e2129b7\49fa.exe
- %TEMP%\iwfmuerjwfewpav.data
- %TEMP%\5244.tmp-shm
- %TEMP%\6ac8.tmp-shm
Sets the 'hidden' attribute to the following files
- %APPDATA%\thwubui
- %APPDATA%\bwcerrg
Deletes the following files
- %TEMP%\kvsekvtmjkzriyh.data
- %TEMP%\iwfmuerjwfewpav.data
- <SYSTEM32>\tasks\time trigger task
- %TEMP%\5244.tmp-shm
- %TEMP%\6ac8.tmp-shm
Deletes itself.
Network activity
Connects to
- 'su####lituyo.org':80
- 'sn####ukeutit.org':80
- 'li#####insteniki.org':80
- 'li####oumumy.org':80
- 'st#####luyastrelia.net':80
- 'ap#.2ip.ua':443
- 'pk#.goog':80
- '79.##7.192.18':80
- 'ze##q.com':80
- 'co###umy.com':80
TCP
HTTP GET requests
- http://pk#.goog/gsr1/gsr1.crt
- http://79.##7.192.18/newmar.exe
- http://co###umy.com/dl/build2.exe
- http://ze##q.com/raud/get.php?pi#############################################
- http://ze##q.com/files/1/build3.exe
HTTP POST requests
- http://su####lituyo.org/
- http://sn####ukeutit.org/
- http://li#####insteniki.org/
- http://li####oumumy.org/
- http://st#####luyastrelia.net/
Other
- 'ap#.2ip.ua':443
UDP
- DNS ASK on###ituyrs.org
- DNS ASK su####lituyo.org
- DNS ASK sn####ukeutit.org
- DNS ASK li#####insteniki.org
- DNS ASK li####oumumy.org
- DNS ASK st#####luyastrelia.net
- DNS ASK ap#.2ip.ua
- DNS ASK pk#.goog
- DNS ASK ze##q.com
- DNS ASK co###umy.com
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%TEMP%\49fa.exe'
- '%TEMP%\51b8.exe'
- '%TEMP%\7aeb.exe'
- '%TEMP%\49fa.exe' --Admin IsNotAutoStart IsNotTask
- '%APPDATA%\thwubui'
- '%WINDIR%\syswow64\icacls.exe' "%LOCALAPPDATA%\78ce57ff-4713-4a19-844d-fa756e2129b7" /deny *S-1-1-0:(OI)(CI)(DE,DC)' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\12E.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\831.bat" "' (with hidden window)
- '%APPDATA%\uuwubui' ' (with hidden window)
- '%APPDATA%\thwubui' ' (with hidden window)
Executes the following
- '<SYSTEM32>\regsvr32.exe' /s %TEMP%\827B.dll
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\831.bat" "
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\12E.bat" "
- '<SYSTEM32>\cmd.exe' /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes"
- '<SYSTEM32>\schtasks.exe' /run /tn "GoogleUpdateTaskMachineQC"
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'%ProgramFiles%\Google\Chrome\updater.exe'"
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''%ProgramFiles%...
- '<SYSTEM32>\taskeng.exe' {C2B21F1F-2A0E-469B-A6C8-0F1E93A395CD} S-1-5-21-3150914307-1777937420-491476919-1000:rphtqmpejiqh\user:Interactive:[1]
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\cmd.exe' /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
- '%WINDIR%\explorer.exe'
- '%WINDIR%\syswow64\explorer.exe'
- '%WINDIR%\syswow64\net1.exe' helpmsg 20
- '%WINDIR%\syswow64\net.exe' helpmsg 20
- '%WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe'
- '%WINDIR%\syswow64\icacls.exe' "%LOCALAPPDATA%\78ce57ff-4713-4a19-844d-fa756e2129b7" /deny *S-1-1-0:(OI)(CI)(DE,DC)
- '<SYSTEM32>\sc.exe' stop dosvc
- '%WINDIR%\syswow64\schtasks.exe' /Query
