Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>abgbmnn.lnk
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im Idle.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im RtkAudio.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im screen.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im Systemfont.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im IntelSvc.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im xmrig.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im FixT3N24.cmd
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im FixT3N24.txt
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im SwithMail.exe
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="BLOCK SMTP 25" dir=out action=block protocol=TCP localport=25
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="BLOCK SMTP 465" dir=out action=block protocol=TCP localport=465
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="BLOCK SMTP 587" dir=out action=block protocol=TCP localport=587
- '%WINDIR%\syswow64\taskkill.exe' /f /im Idle.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im AnyDesk.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im RtkAudio.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im RuntimeBroker.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im cmdow.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im tv_x86.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im screen.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im Systemfont.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im IntelSvc.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im xmrig.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im FixT3N24.cmd
- '%WINDIR%\syswow64\taskkill.exe' /f /im FixT3N24.txt
- '%WINDIR%\syswow64\taskkill.exe' /f /im SwithMail.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\runtimebroker.exe
Modifies file system
Creates the following files
- <Current directory>\all_rtk_clear_ok.bat
- <Current directory>\all_rtk_clear_ok_admin2.bat
- D:\alfares\data\all_rtk_clear_ok_admin.txt
- nul
- <Current directory>\attempting
- <Current directory>\all_rtk_clear_ok.txt
Modifies the HOSTS file.
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C "<Current directory>\All_RTK_clear_ok_admin2.bat"
- '%WINDIR%\syswow64\net.exe' session
- '%WINDIR%\syswow64\net1.exe' session
- '%WINDIR%\syswow64\schtasks.exe' /query /tn "Svtasks"
- '%WINDIR%\syswow64\schtasks.exe' /query /tn "FixT3N24"
- '%WINDIR%\syswow64\sc.exe' query WinRing0_1_2_0
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled"
- '%WINDIR%\syswow64\attrib.exe' -r -h -s "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\takeown.exe' /f "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\icacls.exe' "<DRIVERS>\etc\hosts" /grant administrators:F
- '%WINDIR%\syswow64\findstr.exe' /i "xemhang.vn" "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\findstr.exe' /i "sancovat.com" "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\findstr.exe' /i "emailserver.vn" "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\findstr.exe' /i "pro13.emailserver.vn" "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\findstr.exe' /i "auto.c3pool.org" "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\findstr.exe' /i "c3pool.org" "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\findstr.exe' /i "pool.c3pool.org" "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\findstr.exe' /i "xmr.2miners.com" "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\findstr.exe' /i "2miners.com" "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\findstr.exe' /i "pool.2miners.com" "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\findstr.exe' /i "xmrpool.eu" "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\findstr.exe' /i "supportxmr.com" "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\findstr.exe' /i "minexmr.com" "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\findstr.exe' /i "nanopool.org" "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\findstr.exe' /i "xmr-eu1.nanopool.org" "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\findstr.exe' /i "xmr-eu2.nanopool.org" "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\findstr.exe' /i "www.xemhang.vn" "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\findstr.exe' /i "www.sancovat.com" "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\findstr.exe' /i "eu1.solopool.org" "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\findstr.exe' /i "sg.monero.herominers.com" "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\findstr.exe' /i "de.monero.herominers.com" "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\findstr.exe' /i "moneropool.com" "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\findstr.exe' /i "GHhA5Joo.com" "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\findstr.exe' /i "xmr.GHhA5Joo.com" "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\attrib.exe' +r "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\tasklist.exe'
- '%WINDIR%\syswow64\find.exe' /i "AnyDesk.exe"
- '%WINDIR%\syswow64\cmd.exe' /c reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul
- '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"
- '%WINDIR%\syswow64\cmd.exe' /c reg query "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run" 2>nul
- '%WINDIR%\syswow64\reg.exe' query "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run"
- '%WINDIR%\syswow64\cmd.exe' /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul
- '%WINDIR%\syswow64\reg.exe' query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo Start "
- '%WINDIR%\syswow64\findstr.exe' /i "anydesk radmin zerotier defender securityhealth"
- '%WINDIR%\syswow64\cmd.exe' /C "<Current directory>\All_RTK_clear_ok.bat"
- '%WINDIR%\syswow64\sc.exe' query "Service Network"
- '%WINDIR%\syswow64\sc.exe' query "RuntimeBroker"
- '%WINDIR%\syswow64\sc.exe' query "RtkAudio"
- '%WINDIR%\syswow64\sc.exe' query "IntelSvc"
- '%WINDIR%\syswow64\sc.exe' query "Systemfont"
- '%WINDIR%\syswow64\sc.exe' query "WinRing0x64"
- '%WINDIR%\syswow64\sc.exe' query "svtasks"
- '%WINDIR%\syswow64\cmd.exe' /C "<Current directory>\All_RTK_clear_ok_admin2.bat"' (with hidden window)
