Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\software\microsoft\windows\currentversion\run] '<File name>' = 'wscript.exe //B "%TEMP%\<File name>.vbs"'
- [<HKLM>\software\microsoft\windows\currentversion\run] '<File name>' = 'wscript.exe //B "%TEMP%\<File name>.vbs"'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.vbs
- <SYSTEM32>\tasks\ikqhrh
Creates the following files on removable media
- <Drive name for removable media>:\<File name>.vbs
Malicious functions
Creates and executes the following
- '%TEMP%\bytes.exe'
- '%TEMP%\ixp000.tmp\zgwlp.exe' rebg.zlf
- '%HOMEPATH%\zgwlp.exe'
Injects code into
the following user processes:
- zgwlp.exe
Modifies file system
Creates the following files
- %TEMP%\<File name>.vbs
- %TEMP%\bytes.exe
- %TEMP%\ixp000.tmp\zgwlp.exe
- %TEMP%\ixp000.tmp\rebg.zlf
- %TEMP%\ixp000.tmp\rlpzvyvl.ncd
- %HOMEPATH%\zgwlp.exe
- %APPDATA%\597d9903-ea81-40e6-803a-40d3e5258fa4\run.dat
- %APPDATA%\597d9903-ea81-40e6-803a-40d3e5258fa4\catalog.dat
- %APPDATA%\597d9903-ea81-40e6-803a-40d3e5258fa4\storage.dat
- %APPDATA%\597d9903-ea81-40e6-803a-40d3e5258fa4\settings.bin
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\<File name>.vbs
- %HOMEPATH%\ikqhrh\rebg.zlf
- %HOMEPATH%\ikqhrh\rlpzvyvl.ncd
- %HOMEPATH%\ikqhrh\zgwlp.exe
- %HOMEPATH%\zgwlp.exe
Moves the following files
- from %TEMP%\ixp000.tmp\rebg.zlf to %HOMEPATH%\ikqhrh\rebg.zlf
- from %TEMP%\ixp000.tmp\rlpzvyvl.ncd to %HOMEPATH%\ikqhrh\rlpzvyvl.ncd
- from %TEMP%\ixp000.tmp\zgwlp.exe to %HOMEPATH%\ikqhrh\zgwlp.exe
Network activity
TCP
HTTP POST requests
- http://bl#######7195.portmap.io:47195/is-ready
- http://bl#######7195.portmap.io:47195/is-sending%3C%7C%3EC:/Users/IntelCash/Desktop/FICHIER%20A%20UTILISE/Bytes.exe
UDP
- DNS ASK bl######47195.portmap.io
- DNS ASK bl######35778.portmap.io
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' //B "%TEMP%\<File name>.vbs"
- '<SYSTEM32>\cmd.exe' /c schtasks /create /sc minute /mo 5 /tn ikqhrh /tr "%HOMEPATH%\ikqhrh\zgwlp.exe %HOMEPATH%\ikqhrh\rebg.zlf"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c schtasks /create /sc minute /mo 5 /tn ikqhrh /tr "%HOMEPATH%\ikqhrh\zgwlp.exe %HOMEPATH%\ikqhrh\rebg.zlf"
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 5 /tn ikqhrh /tr "%HOMEPATH%\ikqhrh\zgwlp.exe %HOMEPATH%\ikqhrh\rebg.zlf"
