Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\iexplore___.lnk
- <SYSTEM32>\tasks\iexplore__-pu
- %APPDATA%\microsoft\windows\start menu\programs\startup\firefox___.lnk
- <SYSTEM32>\tasks\firefox__-pu
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\iexplore__-pu] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\iexplore__-pu] 'ImagePath' = 'C:\fb0fdbcd\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe'
- [HKLM\System\CurrentControlSet\Services\firefox__-pu] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\firefox__-pu] 'ImagePath' = 'C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe'
Creates the following services
- 'iexplore__-pu' C:\fb0fdbcd\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe
- 'firefox__-pu' C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /IM iexplore__.exe /F
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="iexplore__-pu-out" dir=out action=allow program="C:\fb0fdbcd\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe" enable=yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="iexplore__-pu-out" dir=in action=allow program="C:\fb0fdbcd\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe" enable=yes
- '<SYSTEM32>\taskkill.exe' /IM firefox__.exe /F
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="firefox__-pu-out" dir=out action=allow program="C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe" enable=yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="firefox__-pu-out" dir=in action=allow program="C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe" enable=yes
Modifies file system
Creates the following files
- C:\fb0fdbcd\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe
- %ALLUSERSPROFILE%\74marbjwzdugrg2ojsnom8ffttkhspptbijyk5gjzw8\nsjo9_ablqsmyb4kxnoyqdml.dll
- %ALLUSERSPROFILE%\74marbjwzdugrg2ojsnom8ffttkhspptbijyk5gjzw8\sz9gfemmse-dck5pbcje-g5b.dll
- %ALLUSERSPROFILE%\dv_0ykgywgqrrxjf\dll.x.tmp
- %ALLUSERSPROFILE%\dv_0ykgywgqrrxjf\dlllister.exe
- %ALLUSERSPROFILE%\wkrrmk1estjnvfv0t1drmu1dmdbprgd3\db\db.db-journal
- C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxa0c5.tmp
- %ALLUSERSPROFILE%\dv_0ykgywgqrrxjf\dlllister64.exe
- C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxa2f7.tmp
- C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxa430.tmp
- %ALLUSERSPROFILE%\wkrrmk1estjnvfv0t1drmu1dmdbprgd3\db\db.db
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\firefox___.lnk
- C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxc45e.tmp
- C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxc559.tmp
- C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxc682.tmp
- C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxe672.tmp
- C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxe6ff.tmp
- C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxe829.tmp
- C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx1081.tmp
- %ALLUSERSPROFILE%\prox_xkct8cxpuc4sg6qtywwzynwri0-90lhlcqiyrq-dndk\proxy\cfg
- C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx10ff.tmp
- %ALLUSERSPROFILE%\prox_xkct8cxpuc4sg6qtywwzynwri0-90lhlcqiyrq-dndk\proxy\payload\commander64.dll
- %ALLUSERSPROFILE%\prox_xkct8cxpuc4sg6qtywwzynwri0-90lhlcqiyrq-dndk\proxy\payload\commander32.dll
- C:\fb0fdbcd\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\rcx4a58.tmp
- C:\fb0fdbcd\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\rcx4b14.tmp
- %WINDIR%\temp\cab5179.tmp
- %WINDIR%\temp\tar517a.tmp
- %WINDIR%\temp\cab519a.tmp
- %WINDIR%\temp\tar519b.tmp
- %WINDIR%\temp\cab54f6.tmp
- %WINDIR%\temp\tar54f7.tmp
- %WINDIR%\temp\cab5518.tmp
- %WINDIR%\temp\tar5519.tmp
- %WINDIR%\temp\cab59ac.tmp
- %WINDIR%\temp\tar59ad.tmp
- %ALLUSERSPROFILE%\exec_xkct8cxpuc4sg6qtywwzynwri0-90lhlcqiyrq-dndk\payload\executor.zip
- %ALLUSERSPROFILE%\exec_xkct8cxpuc4sg6qtywwzynwri0-90lhlcqiyrq-dndk\payload\publisher32.dll
- %ALLUSERSPROFILE%\exec_xkct8cxpuc4sg6qtywwzynwri0-90lhlcqiyrq-dndk\payload\publisher64.dll
- %ALLUSERSPROFILE%\exec_xkct8cxpuc4sg6qtywwzynwri0-90lhlcqiyrq-dndk\cfg
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\iexplore___.lnk
- C:\fb0fdbcd\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\rcx8316.tmp
- %ALLUSERSPROFILE%\prox_xkct8cxpuc4sg6qtywwzynwri0-90lhlcqiyrq-dndk\proxy\payload\proxy.zip
- C:\fb0fdbcd\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\rcx8410.tmp
- C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx11ab.tmp
Deletes the following files
- %WINDIR%\temp\cab5179.tmp
- <SYSTEM32>\tasks\firefox__-pu
- C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- %ALLUSERSPROFILE%\wkrrmk1estjnvfv0t1drmu1dmdbprgd3\db\db.db-journal
- %APPDATA%\microsoft\windows\start menu\programs\startup\iexplore___.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\iexplore___.lnk
- <SYSTEM32>\tasks\iexplore__-pu
- C:\fb0fdbcd\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe
- %ALLUSERSPROFILE%\exec_xkct8cxpuc4sg6qtywwzynwri0-90lhlcqiyrq-dndk\payload\executor.zip
- %WINDIR%\temp\tar59ad.tmp
- %WINDIR%\temp\cab59ac.tmp
- %WINDIR%\temp\tar5519.tmp
- %WINDIR%\temp\cab5518.tmp
- %WINDIR%\temp\tar54f7.tmp
- %WINDIR%\temp\cab54f6.tmp
- %WINDIR%\temp\tar519b.tmp
- %WINDIR%\temp\cab519a.tmp
- %WINDIR%\temp\tar517a.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\firefox___.lnk
- %APPDATA%\microsoft\windows\start menu\programs\startup\firefox___.lnk
Moves the following files
- from C:\fb0fdbcd\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\rcx4a58.tmp to C:\fb0fdbcd\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe
- from C:\fb0fdbcd\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\rcx4b14.tmp to C:\fb0fdbcd\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe
- from C:\fb0fdbcd\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\rcx8410.tmp to C:\fb0fdbcd\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe
- from %ALLUSERSPROFILE%\dv_0ykgywgqrrxjf\dll.x.tmp to %ALLUSERSPROFILE%\dv_0ykgywgqrrxjf\dll.x
- from C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxa0c5.tmp to C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxa2f7.tmp to C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxa430.tmp to C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxc559.tmp to C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxc682.tmp to C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxe6ff.tmp to C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcxe829.tmp to C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx10ff.tmp to C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- from C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\rcx11ab.tmp to C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
Substitutes the following files
- C:\fb0fdbcd\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\iexplore___.lnk
- %ALLUSERSPROFILE%\wkrrmk1estjnvfv0t1drmu1dmdbprgd3\db\db.db-journal
- C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\firefox___.lnk
Network activity
Connects to
- 'ap#.#ithub.com':443
- 'ob#####.#ithubusercontent.com':443
- 'clients3.google.com':80
- 'g.###.mega.co.nz':443
- 'ap#.#pify.org':443
- 'oa####.googleapis.com':443
- 'w.###.mega.co.nz':80
- 'pk#.goog':80
TCP
HTTP GET requests
- http://clients3.google.com/generate_204
- http://w.###.mega.co.nz/sGrPJWzEkCpQEZ3PYzNAJ4PaItc
- http://pk#.goog/gsr1/gsr1.crt
Other
- 'ap#.#ithub.com':443
- 'gi##ub.com':443
- 'ob#####.#ithubusercontent.com':443
- 'g.###.mega.co.nz':443
- 'ap#.#pify.org':443
- 'oa####.googleapis.com':443
UDP
- DNS ASK ap#.#ithub.com
- DNS ASK gi##ub.com
- DNS ASK ob#####.#ithubusercontent.com
- DNS ASK clients3.google.com
- DNS ASK g.###.mega.co.nz
- DNS ASK ap#.#pify.org
- DNS ASK oa####.googleapis.com
- DNS ASK w.###.mega.co.nz
- DNS ASK pk#.goog
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%ALLUSERSPROFILE%\dv_0ykgywgqrrxjf\dlllister.exe' 1204
- '%ALLUSERSPROFILE%\dv_0ykgywgqrrxjf\dlllister.exe' 1252
- '<SYSTEM32>\net.exe' start' (with hidden window)
- '<SYSTEM32>\wbem\wmic.exe' diskdrive get /format:csv' (with hidden window)
- '<SYSTEM32>\sc.exe' query "firefox__-pu"' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox__-pu" /tr "C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe" /sc onlogon /f' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="firefox__-pu-out" dir=in action=allow program="C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe" enable=yes' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="firefox__-pu-out" dir=out action=allow program="C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe" enable=yes' (with hidden window)
- '<SYSTEM32>\sc.exe' create "firefox__-pu" binPath= "C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe" start= auto type= own' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /delete /tn "firefox__-pu" /f' (with hidden window)
- '<SYSTEM32>\sc.exe' delete firefox__-pu' (with hidden window)
- '%ALLUSERSPROFILE%\dv_0ykgywgqrrxjf\dlllister.exe' 1204' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /IM firefox__.exe /F' (with hidden window)
- '%ALLUSERSPROFILE%\dv_0ykgywgqrrxjf\dlllister.exe' 1252' (with hidden window)
- '<SYSTEM32>\rundll32.exe' "%ALLUSERSPROFILE%\74maRBJWzDugRG2OJSnOM8FfttKhsPptBijyk5gjzW8\sz9gfEMmSe-Dck5PbCje-g5b.dll" ,Start' (with hidden window)
- '<SYSTEM32>\rundll32.exe' "%ALLUSERSPROFILE%\74maRBJWzDugRG2OJSnOM8FfttKhsPptBijyk5gjzW8\nsjo9_AbLqsmYB4kXnoYqDml.dll" ,Start' (with hidden window)
- '<SYSTEM32>\sc.exe' query "iexplore__-pu"' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore__-pu" /tr "C:\fb0fdbcd\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe" /sc onlogon /f' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="iexplore__-pu-out" dir=in action=allow program="C:\fb0fdbcd\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe" enable=yes' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="iexplore__-pu-out" dir=out action=allow program="C:\fb0fdbcd\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe" enable=yes' (with hidden window)
- '<SYSTEM32>\sc.exe' create "iexplore__-pu" binPath= "C:\fb0fdbcd\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe" start= auto type= own' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /delete /tn "iexplore__-pu" /f' (with hidden window)
- '<SYSTEM32>\sc.exe' delete iexplore__-pu' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /IM iexplore__.exe /F' (with hidden window)
- '<SYSTEM32>\wbem\wmic.exe' OS get /format:csv' (with hidden window)
- '<SYSTEM32>\wbem\wmic.exe' CPU get /format:csv' (with hidden window)
Executes the following
- '<SYSTEM32>\net.exe' start
- '<SYSTEM32>\wbem\wmic.exe' diskdrive get /format:csv
- '<SYSTEM32>\sc.exe' query "firefox__-pu"
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox__-pu" /tr "C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe" /sc onlogon /f
- '<SYSTEM32>\sc.exe' create "firefox__-pu" binPath= "C:\fb0fdbcd\fccc51e18021551cb6993f91aede91ac96224b12b7cf190824fc9e79aa05f085\firefox__.exe" start= auto type= own
- '<SYSTEM32>\schtasks.exe' /delete /tn "firefox__-pu" /f
- '<SYSTEM32>\sc.exe' delete firefox__-pu
- '<SYSTEM32>\wbem\wmic.exe' OS get /format:csv
- '<SYSTEM32>\rundll32.exe' "%ALLUSERSPROFILE%\74maRBJWzDugRG2OJSnOM8FfttKhsPptBijyk5gjzW8\sz9gfEMmSe-Dck5PbCje-g5b.dll" ,Start
- '<SYSTEM32>\sc.exe' query "iexplore__-pu"
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore__-pu" /tr "C:\fb0fdbcd\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe" /sc onlogon /f
- '<SYSTEM32>\sc.exe' create "iexplore__-pu" binPath= "C:\fb0fdbcd\10930ebd231310976546667f6bae61cc8f5ce4e30e9034a0c523f8180f6dd9a7\iexplore__.exe" start= auto type= own
- '<SYSTEM32>\schtasks.exe' /delete /tn "iexplore__-pu" /f
- '<SYSTEM32>\sc.exe' delete iexplore__-pu
- '<SYSTEM32>\net1.exe' start
- '<SYSTEM32>\rundll32.exe' "%ALLUSERSPROFILE%\74maRBJWzDugRG2OJSnOM8FfttKhsPptBijyk5gjzW8\nsjo9_AbLqsmYB4kXnoYqDml.dll" ,Start
- '<SYSTEM32>\wbem\wmic.exe' CPU get /format:csv
