Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\495efb143223b806
- %WINDIR%\tasks\jusched.job
- <SYSTEM32>\tasks\jusched
Creates the following files on removable media
- <Drive name for removable media>:\update.exe
- <Drive name for removable media>:\documents.lnk
- <Drive name for removable media>:\work_report_2026.pdf.lnk
- <Drive name for removable media>:\vacation_photos.lnk
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- file extensions
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\0_979125.exe
- %APPDATA%\495efb143223b806\495efb143223b806.exe
- %TEMP%\1_982250.exe
- %TEMP%\mykwiugs.exe
- %TEMP%\2_984703.exe
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %TEMP%\08e25196df\jusched.exe
- %TEMP%\is-cwgjf7oo57.tmp\mykwiugs.tmp
- %TEMP%\is-egauluvn0a.tmp\_isetup\_setup64.tmp
- %TEMP%\is-egauluvn0a.tmp\_isetup\_isdecmp.dll
- %HOMEPATH%\update.exe
- %HOMEPATH%\desktop\my documents.lnk
- %HOMEPATH%\desktop\downloads.lnk
- %HOMEPATH%\desktop\work files.lnk
- %HOMEPATH%\desktop\shared photos.lnk
- %HOMEPATH%\.oracle_jre_usage\update.exe
- %HOMEPATH%\.oracle_jre_usage\.oracle_jre_usage - files.lnk
- %HOMEPATH%\3d objects\update.exe
- %HOMEPATH%\3d objects\3d objects - files.lnk
- %HOMEPATH%\contacts\update.exe
- %HOMEPATH%\contacts\contacts - files.lnk
- %HOMEPATH%\desktop\update.exe
- %HOMEPATH%\desktop\desktop - files.lnk
- %HOMEPATH%\documents\update.exe
- %HOMEPATH%\documents\documents - files.lnk
- %HOMEPATH%\downloads\update.exe
- %HOMEPATH%\downloads\downloads - files.lnk
- %HOMEPATH%\favorites\update.exe
- %HOMEPATH%\favorites\favorites - files.lnk
- %HOMEPATH%\favorites\links\update.exe
- %HOMEPATH%\favorites\links\links - files.lnk
- %HOMEPATH%\links\update.exe
- %HOMEPATH%\links\links - files.lnk
- %HOMEPATH%\music\update.exe
- %HOMEPATH%\music\music - files.lnk
- %HOMEPATH%\pictures\update.exe
- %HOMEPATH%\pictures\pictures - files.lnk
- %HOMEPATH%\pictures\camera roll\update.exe
- %HOMEPATH%\pictures\camera roll\camera roll - files.lnk
- %HOMEPATH%\saved games\update.exe
- %HOMEPATH%\saved games\saved games - files.lnk
- %HOMEPATH%\searches\update.exe
- %HOMEPATH%\searches\searches - files.lnk
- %HOMEPATH%\videos\update.exe
- %HOMEPATH%\videos\videos - files.lnk
- D:\update.exe
- %TEMP%\10000380101\progressive_8127.exe
- %TEMP%\is-8m04cgocds.tmp\progressive_8127.tmp
- %TEMP%\is-xzpemiax0e.tmp\_isetup\_setup64.tmp
- %TEMP%\is-xzpemiax0e.tmp\_isetup\_isdecmp.dll
- %TEMP%\10000400101\10x06x2026_x64.exe
- %TEMP%\10000420101\ldr.exe
- %TEMP%\rizqhypg.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\495efb143223b806\495efb143223b806.exe
- %HOMEPATH%\update.exe
- %HOMEPATH%\.oracle_jre_usage\update.exe
- %HOMEPATH%\3d objects\update.exe
- %HOMEPATH%\contacts\update.exe
- %HOMEPATH%\desktop\update.exe
- %HOMEPATH%\documents\update.exe
- %HOMEPATH%\downloads\update.exe
- %HOMEPATH%\favorites\update.exe
- %HOMEPATH%\favorites\links\update.exe
- %HOMEPATH%\links\update.exe
- %HOMEPATH%\music\update.exe
- %HOMEPATH%\pictures\update.exe
- %HOMEPATH%\pictures\camera roll\update.exe
- %HOMEPATH%\saved games\update.exe
- %HOMEPATH%\searches\update.exe
- %HOMEPATH%\videos\update.exe
- D:\update.exe
- <Drive name for removable media>:\update.exe
Modifies the following files
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_idx.db
Network activity
Connects to
- '19#.#51.107.104':80
- '62.##.226.159':80
- '19#.#51.107.130':80
TCP
HTTP GET requests
- http://62.##.226.159/01x06x2026_x64.exe
- http://19#.#51.107.104/Amadey.exe
HTTP POST requests
- http://19#.#51.107.130/16b022998f754137b60a.php
- http://19#.#51.107.130/h84jjfAr/index.php
- http://19#.#51.107.104/Psd8eZaW/index.php
UDP
- DNS ASK d6###############a3wzsvorkngjcf8b4x0twpslohkdg9c5y1uxqtmpil.com
- DNS ASK ry#############gxel2jq7ovctahyfm3kr8pwdubizgn4ls9qx.com
Miscellaneous
Creates and executes the following
- '%TEMP%\0_979125.exe'
- '%TEMP%\1_982250.exe'
- '%TEMP%\2_984703.exe'
- '%TEMP%\mykwiugs.exe'
- '%TEMP%\is-cwgjf7oo57.tmp\mykwiugs.tmp' /SL5="$A01D8,3978993,842240,%TEMP%\mykwiugs.exe"
- '%TEMP%\08e25196df\jusched.exe'
- '%APPDATA%\495efb143223b806\495efb143223b806.exe'
- '%TEMP%\10000380101\progressive_8127.exe'
- '%TEMP%\is-8m04cgocds.tmp\progressive_8127.tmp' /SL5="$1801DC,3978993,842240,%TEMP%\10000380101\Progressive_8127.exe"
- '%TEMP%\10000400101\10x06x2026_x64.exe'
- '%TEMP%\10000420101\ldr.exe'
- '%TEMP%\rizqhypg.exe'
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /query /tn "495EFB143223B806"
- '%WINDIR%\syswow64\schtasks.exe' /create /sc minute /tn "495EFB143223B806" /tr "%APPDATA%\495EFB143223B806\495EFB143223B806.exe"
- '%WINDIR%\syswow64\svchost.exe' netsvcs
- '%TEMP%\0_979125.exe' ' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /query /tn "495EFB143223B806"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /sc minute /tn "495EFB143223B806" /tr "%APPDATA%\495EFB143223B806\495EFB143223B806.exe"' (with hidden window)
- '%TEMP%\1_982250.exe' ' (with hidden window)
- '%TEMP%\2_984703.exe' ' (with hidden window)
- '%TEMP%\mykwiugs.exe' ' (with hidden window)
- '%TEMP%\08e25196df\jusched.exe' ' (with hidden window)
- '%TEMP%\10000380101\progressive_8127.exe' ' (with hidden window)
- '%TEMP%\10000400101\10x06x2026_x64.exe' ' (with hidden window)
- '%TEMP%\10000420101\ldr.exe' ' (with hidden window)
- '%TEMP%\rizqhypg.exe' ' (with hidden window)
