Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\xbazixbpfj.url
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\wuapp.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\wuapp.exe
Modifies file system
Creates the following files
- %PROGRAMDATA%\iscupjbuvq\4e064bee1f
- %PROGRAMDATA%\iscupjbuvq\cfgi
- %PROGRAMDATA%\iscupjbuvq\cfg
- %PROGRAMDATA%\iscupjbuvq\taskhostws
- %PROGRAMDATA%\iscupjbuvq\r.vbs
Deletes the following files
- %PROGRAMDATA%\iscupjbuvq\r.vbs
Moves the following files
- from %PROGRAMDATA%\iscupjbuvq\taskhostws to %PROGRAMDATA%\iscupjbuvq\taskhostws.exe
Network activity
Connects to
- '37.##.215.222':5790
TCP
HTTP GET requests
- http://37.##.212.223/xmr.txt
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "%PROGRAMDATA%\iscupJbUvq\r.vbs"
Executes the following
- '<SYSTEM32>\wuapp.exe' -c "%PROGRAMDATA%\iscupJbUvq\cfg"
- '<SYSTEM32>\wuapp.exe' -c "%PROGRAMDATA%\iscupJbUvq\cfgi"
- '<SYSTEM32>\cmd.exe' /C WScript "%PROGRAMDATA%\iscupJbUvq\r.vbs"
