Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN] 'DllName' = 'RWLN.dll'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN] 'Logon' = 'WLEventLogon'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN] 'Startup' = 'WLEventStartup'
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\Coreografia] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Coreografia] 'ImagePath' = 'C:\jkefyx\ibvsxuz.exe'
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] 'C:\jkefyx\ibvsxuz.exe' = 'C:\jkefyx\ibvsxuz.exe:*:Enabled:RMS - Ho...
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im miniperl.exe
- '<SYSTEM32>\taskkill.exe' /f /im ibvsxuz.exe
- '<SYSTEM32>\taskkill.exe' /f /im rfusclient.exe
- '<SYSTEM32>\taskkill.exe' /f /im rutserv.exe
- '<SYSTEM32>\taskkill.exe' /f /im SystemExplorer.exe
- '<SYSTEM32>\taskkill.exe' /f /im SND 2.2.exe
- '<SYSTEM32>\taskkill.exe' /f /im SND.exe
- '<SYSTEM32>\taskkill.exe' /f /im ida.exe
- '<SYSTEM32>\taskkill.exe' /f /im dede.exe
- '<SYSTEM32>\taskkill.exe' /f /im wirwshark.exe
- '<SYSTEM32>\taskkill.exe' /f /im Charles.exe
- '<SYSTEM32>\taskkill.exe' /f /im HttpAnalyzerStdV6.exe
- '<SYSTEM32>\taskkill.exe' /f /im HttpAnalyzerStdV7.exe
- '<SYSTEM32>\taskkill.exe' /f /im ollydbg.exe
- '<SYSTEM32>\taskkill.exe' /f /im mysqld.exe
- '<SYSTEM32>\taskkill.exe' /f /im httpd.exe
- '<SYSTEM32>\taskkill.exe' /f /im xcqbmozvrc.exe
- '<SYSTEM32>\taskkill.exe' /f /im rar.exe
Modifies file system
Creates the following files
- C:\rvqxl\run.vbs
- C:\rvqxl\rar.exe
- C:\rvqxl\mqop.bat
- C:\rvqxl\geiomc.rar
- C:\rvqxl\mrzze.vbs
- C:\rvqxl\vp8encoder.dll
- C:\rvqxl\qjizk.vbs
- C:\rvqxl\ibvsxuz.exe
- C:\rvqxl\xcqbmozvrc.exe
- C:\rvqxl\ltvuyf.bat
- C:\rvqxl\nodf.reg
- C:\jkefyx\ibvsxuz.exe
- nul
- C:\jkefyx\xcqbmozvrc.exe
- C:\jkefyx\nodf.reg
- C:\jkefyx\vp8encoder.dll
Sets the 'hidden' attribute to the following files
- C:\jkefyx\ibvsxuz.exe
- C:\jkefyx\nodf.reg
- C:\jkefyx\vp8encoder.dll
- C:\jkefyx\xcqbmozvrc.exe
Deletes the following files
- C:\rvqxl\mrzze.vbs
- C:\rvqxl\geiomc.rar
- C:\jkefyx\nodf.reg
- C:\rvqxl\ibvsxuz.exe
- C:\rvqxl\mqop.bat
- C:\rvqxl\nodf.reg
- C:\rvqxl\qjizk.vbs
- C:\rvqxl\rar.exe
- C:\rvqxl\run.vbs
- C:\rvqxl\vp8encoder.dll
- C:\rvqxl\xcqbmozvrc.exe
Network activity
UDP
- DNS ASK rm##sys.ru
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "C:\rvqxl\mrzze.vbs"
- 'C:\rvqxl\rar.exe' e -p17233023 geiomc.rar
- '<SYSTEM32>\wscript.exe' "C:\rvqxl\qjizk.vbs"
- 'C:\jkefyx\ibvsxuz.exe' /silentinstall
- 'C:\jkefyx\ibvsxuz.exe' /firewall
- 'C:\jkefyx\ibvsxuz.exe' /start
- 'C:\jkefyx\ibvsxuz.exe'
- 'C:\jkefyx\xcqbmozvrc.exe' /tray
- '<SYSTEM32>\cmd.exe' /c ""C:\rvqxl\mqop.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""C:\rvqxl\ltvuyf.bat" "' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""C:\rvqxl\mqop.bat" "
- '<SYSTEM32>\attrib.exe' +s +h "C:\jkefyx\*.*"
- '<SYSTEM32>\sc.exe' config Coreografia group= "Network Service"
- '<SYSTEM32>\sc.exe' config Coreografia type= share
- '<SYSTEM32>\sc.exe' description Coreografia "Allows Remote Manipulator System users to connect to this machine."
- '<SYSTEM32>\sc.exe' config Coreografia DisplayName= "Organothiophosphate"
- '<SYSTEM32>\sc.exe' config Coreografia obj= LocalSystem type= interact type= own
- '<SYSTEM32>\sc.exe' failure Coreografia reset= 0 actions= restart/1000/restart/1000/restart/1000
- '%WINDIR%\regedit.exe' /s nodf.reg
- '%WINDIR%\regedit.exe' /s "nodf.reg"
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\System Corporation Update" /f
- '<SYSTEM32>\attrib.exe' -s -h "C:\jkefyx"
- '<SYSTEM32>\attrib.exe' -s -h "C:\jkefyx\*.*"
- '<SYSTEM32>\sc.exe' delete RManService
- '<SYSTEM32>\sc.exe' delete Coreografia
- '<SYSTEM32>\sc.exe' stop RManService
- '<SYSTEM32>\sc.exe' stop Coreografia
- '<SYSTEM32>\netsh.exe' advfirewall set allprofiles state off
- '<SYSTEM32>\attrib.exe' +s +h "C:\rvqxl"
- '<SYSTEM32>\cmd.exe' /c ""C:\rvqxl\ltvuyf.bat" "
- '<SYSTEM32>\attrib.exe' +s +h "C:\jkefyx"
- '<SYSTEM32>\attrib.exe' -s -h "C:\jkefyx\nodf.reg"
