Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\systemfilemain.exe
Malicious functions
Launches a large number of processes
Modifies file system
Creates the following files
- %TEMP%\etilqs_ejnfucm6lvkoalf
- %TEMP%\etilqs_blwkyrz7gdhpy4p
- %TEMP%\etilqs_eh5xuqbleeulnwk
Network activity
Connects to
- 'gs.###dex.com.tr':443
- 'en######d-tbn0.gstatic.com':443
- 'tr##kino.me':443
- 'clients3.google.com':443
- 'tr######e.googleapis.com':443
- 'clients4.google.com':443
- 'clients2.google.com':443
- 'ss#.#static.com':443
- 'eb##ity.com':443
- 'cd##.#vvstream.pro':443
- 'yandex.ru':443
- 'ya###tic.net':443
- 'av#####.mds.yandex.net':443
- 'im###.rl0.ru':443
- 'si##i.name':443
- 'x1.#.lencr.org':80
- 'cd####.mndcdn.net':443
- 'er#.#oloe.me':443
- 'cd#####.boyfriendtv.com':443
- 'im#.####no.net':443
- 'im#.##gboss.love':443
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://www.gs##tic.com/generate_204
Other
- 'gs.###dex.com.tr':443
- 'en######d-tbn0.gstatic.com':443
- 'tr##kino.me':443
- 'clients3.google.com':443
- 'tr######e.googleapis.com':443
- 'clients4.google.com':443
- 'ss#.#static.com':443
- 'eb##ity.com':443
- 'cd##.#vvstream.pro':443
- 'google.com':443
- 'ya###tic.net':443
- 'av#####.mds.yandex.net':443
- 'im###.rl0.ru':443
- 'si##i.name':443
- 'cd####.mndcdn.net':443
- 'safebrowsing.google.com':443
- 'alt2-safebrowsing.google.com':443
- 'er#.#oloe.me':443
- 'cd#####.boyfriendtv.com':443
- 'im#.####no.net':443
- 'im#.##gboss.love':443
UDP
- DNS ASK google.com
- DNS ASK gs.###dex.com.tr
- DNS ASK en######d-tbn0.gstatic.com
- DNS ASK tr##kino.me
- DNS ASK clients3.google.com
- DNS ASK tr######e.googleapis.com
- DNS ASK clients4.google.com
- DNS ASK clients2.google.com
- DNS ASK ss#.#static.com
- DNS ASK eb##ity.com
- DNS ASK cd##.#vvstream.pro
- DNS ASK yandex.ru
- DNS ASK ya###tic.net
- DNS ASK av#####.mds.yandex.net
- DNS ASK im###.rl0.ru
- DNS ASK si##i.name
- DNS ASK x1.#.lencr.org
- DNS ASK gs##tic.com
- DNS ASK cd####.mndcdn.net
- DNS ASK safebrowsing.google.com
- DNS ASK alt2-safebrowsing.google.com
- DNS ASK er#.#oloe.me
- DNS ASK cd#####.boyfriendtv.com
- DNS ASK im#.####no.net
- DNS ASK im#.##gboss.love
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Google\Chrome\User Data'
Creates and executes the following
- '%APPDATA%\microsoft\windows\start menu\programs\startup\systemfilemain.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c start chrome --new-window https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSaT0aJZcqMrqQD1DQquXbXs6jRjeo52M7cxQ&s
- '<SYSTEM32>\cmd.exe' /c start chrome --new-window https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRDURJbMNIyO7OUsOyFcrYKD557HuvnZ9cM2DVtVTREImcvlJKcG_moPcvy9kjEwd6puCU&usqp=CAU
- '<SYSTEM32>\cmd.exe' /c start chrome --new-window https://gs.yandex.com.tr/video/preview/6149572662745161180
- '<SYSTEM32>\cmd.exe' /c start chrome --new-window https://trahkino.me/contents/videos_screenshots/49000/49818/preview.jpg
- '<SYSTEM32>\cmd.exe' /c start chrome --new-window https://trahkino.me/contents/videos_screenshots/99000/99322/preview.mp4.jpg
- '<SYSTEM32>\cmd.exe' /c start chrome --new-window https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQ_6Vk7GtLKBxAsBNnjnNIlgG8hABXwuiRlGX-MtcmDh0gM9M_x-JXl20b6hA6LBo9LQcA&usqp=CAU
- '<SYSTEM32>\cmd.exe' /c start chrome --new-window https://ebality.com/6968621/5.jpg
- '<SYSTEM32>\cmd.exe' /c start chrome --new-window https://cdn2.pvvstream.pro/videos/-190626523/456239037/preview_800.jpg?secure=1751026536-8KgW%2Fi00pVTCEbA5Rhv7fb1Hhb66aHSZ%2BVKX785B%2FGQ%3D
- '<SYSTEM32>\cmd.exe' /c start chrome --new-window https://img07.rl0.ru/6d7fc9ebe478fd65efb7d705b7df9a9d/c1280x1125/dilatationanale.d.i.pic.centerblog.net/o/668afd20.jpg
- '<SYSTEM32>\cmd.exe' /c start chrome --new-window https://siski.name/uploads/posts/2021-12/1639748773_4-siski-name-p-porno-muzhskie-piski-negrov-4.jpg
- '<SYSTEM32>\cmd.exe' /c start chrome --new-window https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSQDeFipBpgG_Nc--2uKW29Rsn0yhcWuXFt4A&s
- '<SYSTEM32>\cmd.exe' /c start chrome --new-window https://cdn015.mndcdn.net/photo/5/1/4/34eba0d4ae083d82293b75acadc30381_view.jpg
- '<SYSTEM32>\cmd.exe' /c start chrome --new-window https://ero.goloe.me/uploads/posts/2021-12/1640847446_14-goloe-me-p-erotika-bolshikh-khuev-geev-25.jpg
- '<SYSTEM32>\cmd.exe' /c start chrome --new-window https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSA_dQ7CJ7qs_dFsf6JLKOy105tGxbL8mJDTA&s
- '<SYSTEM32>\cmd.exe' /c start chrome --new-window https://cdn77-t.boyfriendtv.com/b-boyfriendtv/thumbs/bftv-320x240/2025-01/79/a46dfca79318c5d299c5ff191e6f00a24.mp4-320x240-5.jpg
- '<SYSTEM32>\cmd.exe' /c start chrome --new-window https://img.5porno.net/archive/66/5/65439/9-540x360.jpg
- '<SYSTEM32>\cmd.exe' /c start chrome --new-window https://img.bigboss.love/thumbs/66/5/65403/4-540x360.jpg
- '<SYSTEM32>\cmd.exe' /c start chrome --new-window https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRbk04gmaXUixL1Q7T6gu2DcsyqMPTZ_UWXhg&s
- '<SYSTEM32>\cmd.exe' /c start chrome --new-window https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRArrjEUAPrx6LYRIH3a6MlWULdU5OjQu70sQ&s
- '<SYSTEM32>\cmd.exe' /c start chrome --new-window https://ic-vt-nss.xhcdn.com/a/MjIzNDA0MDlmMGNhM2RmZjhkOWU3NzhiOGZiMGRiNGE/s(w:2560,h:1440),webp/021/547/855/v2/2560x1440.247.webp
- '<SYSTEM32>\cmd.exe' /c start chrome --new-window https://s.erocdn.com/399/005/000/04.jpg
- '<SYSTEM32>\cmd.exe' /c start chrome --new-window https://ic-vt-nss.xhcdn.com/a/ZGI5Nzc3N2JmMDUxNjUwOWY0YTNlMGRjZWU5ODIwNDk/s(w:1280,h:720),webp/012/206/396/1280x720.c.jpg.v1565685360
- '<SYSTEM32>\cmd.exe' /c start chrome --new-window https://img.bigboss.love/thumbs/48/6/47509/10-540x360.jpg
- '<SYSTEM32>\cmd.exe' /c start chrome --new-window https://ic-vt-nss.xhcdn.com/a/M2IyNDFiOGY1MWUzOWFjY2JmN2Y0YzY4OTVhYmE1NGE/s(w:2560,h:1440),webp/019/043/332/v2/2560x1440.251.webp
- '%APPDATA%\microsoft\windows\start menu\programs\startup\systemfilemain.exe' ' (with hidden window)
