Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'sdfhjrewwrgsdfghjhgrertyuuyt.exe' = '%TEMP%\15852723\vpl.exe %TEMP%\15852723\vlg=cae'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'AutoUpdate' = '%APPDATA%\log\AutoUpdate.exe'
Malicious functions:
To complicate detection of its presence in the operating system,
modifies the following system settings:
- Hides taskbar notifications
Executes the following:
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram program = STcONaURjstoJeQ(uMqeEfSfaGeNmho("yJmAEIBBXdvRXSFRGegUiJnA")) name = STcONaURjstoJeQ(uMqeEfSfaGeNmho("XQ0V1bwVGZ0FQZ==")) mode = ENABLE
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Modifies file system:
Creates the following files:
- %TEMP%\15852723\dug.ico
- %TEMP%\15852723\pib.jpg
- %TEMP%\15852723\edv.pdf
- %TEMP%\15852723\lwq.icm
- %TEMP%\15852723\fbu.txt
- %TEMP%\15852723\ekr.dat
- %TEMP%\15852723\ibs.jpg
- %TEMP%\15852723\num.mp4
- %TEMP%\15852723\vbb.bmp
- %TEMP%\15852723\adp.icm
- %TEMP%\15852723\fmp.icm
- %TEMP%\15852723\eks.ppt
- %TEMP%\15852723\snq.bmp
- %TEMP%\15852723\kiu.txt
- %TEMP%\15852723\bhv.txt
- %TEMP%\15852723\aei.dat
- %TEMP%\15852723\jpm.jpg
- %TEMP%\15852723\nap.docx
- %TEMP%\15852723\RCOYV
- %TEMP%\aut1.tmp
- %TEMP%\iriiior
- %TEMP%\aut2.tmp
- %APPDATA%\log\AutoUpdate.exe
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\despacito[1].file
- %TEMP%\15852723\htp.dat
- %TEMP%\15852723\smj.dat
- %TEMP%\15852723\thb.ppt
- %TEMP%\15852723\hkm.pdf
- %TEMP%\15852723\hit.xl
- %TEMP%\15852723\vpl.exe
- %TEMP%\15852723\wcn.icm
- %TEMP%\15852723\ior.mp4
- %TEMP%\15852723\xem.bmp
- %TEMP%\15852723\nsw.xl
- %TEMP%\15852723\xsi.ppt
- %TEMP%\15852723\vbl.ico
- %TEMP%\15852723\rkk.ico
- %TEMP%\15852723\tnb.icm
- %TEMP%\15852723\xji.ppt
- %TEMP%\15852723\xvx.docx
- %TEMP%\15852723\vlg=cae
- %TEMP%\15852723\qtp.jpg
- %TEMP%\15852723\lsb.txt
- %TEMP%\15852723\gwj.xl
- %TEMP%\15852723\rja.txt
- %TEMP%\15852723\lev.icm
- %TEMP%\15852723\jld.pdf
- %TEMP%\15852723\aqe.pdf
- %TEMP%\15852723\lsn.pdf
- %TEMP%\15852723\ksv.dat
- %TEMP%\15852723\cuq.txt
- %TEMP%\15852723\qls.dat
- %TEMP%\15852723\dbe.docx
- %TEMP%\15852723\oth.mp4
- %APPDATA%\log\pass.exe
- %APPDATA%\log\Passwords.txt
Sets the 'hidden' attribute to the following files:
- %TEMP%\15852723\adp.icm
- %TEMP%\15852723\nsw.xl
- %TEMP%\15852723\num.mp4
- %TEMP%\15852723\oth.mp4
- %TEMP%\15852723\pib.jpg
- %TEMP%\15852723\qls.dat
- %TEMP%\15852723\qtp.jpg
- %TEMP%\15852723\rja.txt
- %TEMP%\15852723\rkk.ico
- %TEMP%\15852723\lwq.icm
- %TEMP%\15852723\nap.docx
- %TEMP%\15852723\smj.dat
- %TEMP%\15852723\tnb.icm
- %TEMP%\15852723\vbb.bmp
- %TEMP%\15852723\vbl.ico
- %TEMP%\15852723\vlg=cae
- %TEMP%\15852723\vpl.exe
- %TEMP%\15852723\wcn.icm
- %TEMP%\15852723\xem.bmp
- %TEMP%\15852723\xji.ppt
- %TEMP%\15852723\snq.bmp
- %TEMP%\15852723\thb.ppt
- %TEMP%\15852723\lsn.pdf
- %TEMP%\15852723\lsb.txt
- %TEMP%\15852723\lev.icm
- %TEMP%\15852723\aqe.pdf
- %TEMP%\15852723\bhv.txt
- %TEMP%\15852723\cuq.txt
- %TEMP%\15852723\dbe.docx
- %TEMP%\15852723\dug.ico
- %TEMP%\15852723\edv.pdf
- %TEMP%\15852723\ekr.dat
- %TEMP%\15852723\eks.ppt
- %TEMP%\15852723\fbu.txt
- %TEMP%\15852723\aei.dat
- %TEMP%\15852723\fmp.icm
- %TEMP%\15852723\hit.xl
- %TEMP%\15852723\hkm.pdf
- %TEMP%\15852723\htp.dat
- %TEMP%\15852723\ibs.jpg
- %TEMP%\15852723\ior.mp4
- %TEMP%\15852723\jld.pdf
- %TEMP%\15852723\jpm.jpg
- %TEMP%\15852723\kiu.txt
- %TEMP%\15852723\ksv.dat
- %TEMP%\15852723\gwj.xl
- %TEMP%\15852723\xsi.ppt
- %TEMP%\15852723\xvx.docx
Deletes the following files:
- %TEMP%\aut1.tmp
- %TEMP%\iriiior
- %TEMP%\aut2.tmp
- %TEMP%\15852723\RCOYV
Network activity:
Connects to:
- '18#.#0.53.221':80
TCP:
HTTP GET requests:
- http://18#.#0.53.221/despacito.file
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%TEMP%\15852723\vpl.exe' vlg=cae
- '%TEMP%\15852723\vpl.exe' %TEMP%\15852723\RCOYV
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
- '<SYSTEM32>\cmd.exe' /c netsh firewall add allowedprogram program = STcONaURjstoJeQ(uMqeEfSfaGeNmho("yJmAEIBBXdvRXSFRGegUiJnA")) name = STcONaURjstoJeQ(uMqeEfSfaGeNmho("XQ0V1bwVGZ0FQZ==")) mode = ENABLE
- '<SYSTEM32>\cmd.exe' /c %APPDATA%\log\pass.exe all
