Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\At1.job
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\rjulqitnvrxnkbe] 'imagepath' = '%WINDIR%\TEMP\3.tmp'
Malicious functions:
Creates and executes the following:
- '%TEMP%\46024292.tmp' "%TEMP%\1581927021.bin"
- '%TEMP%\is-QT3KP.tmp\301379443.tmp' /SL5="$1013C,15004470,53248,%TEMP%\301379443.tmp"
- '%TEMP%\2311026560.tmp' "%TEMP%\1581927021.bin"
- '%TEMP%\301379443.tmp'
- '%TEMP%\<File name>.exe'
- '%TEMP%\svchost.exe'
- '%TEMP%\Total Video Converter v3.61.exe'
Executes the following:
- '<SYSTEM32>\at.exe' 14:28 /every:2,5,8,11,14,17,20,23,26,29 "<SYSTEM32>\fttp.exe"
- '<SYSTEM32>\cmd.exe' /c at 14:28 /every:2,5,8,11,14,17,20,23,26,29 "<SYSTEM32>\fttp.exe"
Injects code into
the following system processes:
- <SYSTEM32>\spoolsv.exe
Registers BHO:
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{369913F5-B17E-4FE7-84BD-D62C004F7801}']
Modifies file system:
Creates the following files:
- %TEMP%\1581927021.bin
- %TEMP%\46024292.tmp
- %WINDIR%\Temp\3.tmp
- %TEMP%\2311026560.tmp
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\indeh[1].php
- <SYSTEM32>\fttp.exe
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\google[1]
- %TEMP%\batmete.dll
- %TEMP%\hseqi.dll
- %TEMP%\<File name>.exe
- %TEMP%\svchost.exe
- %TEMP%\1.tmp
- %TEMP%\301379443.tmp
- %TEMP%\Total Video Converter v3.61.exe
Deletes the following files:
- %TEMP%\46024292.tmp
- <SYSTEM32>\spool\prtprocs\w32x86\2.tmp
- %WINDIR%\Temp\3.tmp
Moves the following files:
- from %TEMP%\svchost.exe to %TEMP%\4.tmp
- from %TEMP%\1.tmp to <SYSTEM32>\spool\prtprocs\w32x86\2.tmp
- from %TEMP%\batmete.dll to <SYSTEM32>\batmete.dll
Network activity:
Connects to:
- 'kw###ame.com':80
- '74.##5.232.51':80
- 'localhost':1036
TCP:
HTTP GET requests:
- http://kw###ame.com/indeh.php?u=########################################
- http://google.com/ via 74.##5.232.51
UDP:
- DNS ASK kw###ame.com
- DNS ASK google.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
