Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'w' = '"%TEMP%\QV55BMWOELRZNHNPHVPYRVNRAAG74ANO..EXE"'
Creates or modifies the following files
- %WINDIR%\tasks\us.job
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\WindowsInput] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\WindowsInput] 'ImagePath' = '"<SYSTEM32>\WindowsInput.exe"'
Modifies file system
Creates the following files
- %TEMP%\99fcid2wzn1o9aalhva7iw4mmddlapnv..exe
- %TEMP%\mwqvpzvd.dll
- %TEMP%\res4.tmp
- %TEMP%\csc3.tmp
- %TEMP%\mwqvpzvd.out
- %TEMP%\mwqvpzvd.cmdline
- %TEMP%\mwqvpzvd.0.cs
- %ProgramFiles%\s\s.exe.config
- %ProgramFiles%\s\s.exe
- <SYSTEM32>\windowsinput.installstate
- <SYSTEM32>\windowsinput.exe.config
- <SYSTEM32>\windowsinput.exe
- %TEMP%\axhiu02l.dll
- %TEMP%\res2.tmp
- %TEMP%\csc1.tmp
- %TEMP%\axhiu02l.out
- %TEMP%\axhiu02l.cmdline
- %TEMP%\axhiu02l.0.cs
- %TEMP%\is-ohr6n.tmp\vsdyis5hsvd8tekrfagsqooywcdfxgej..tmp
- %TEMP%\vsdyis5hsvd8tekrfagsqooywcdfxgej..exe
- %TEMP%\sqhw5uoz2dadyburjqfn2sw4m5tspjjq..exe
- %TEMP%\qv55bmwoelrznhnphvpyrvnraag74ano..exe
- %TEMP%\og.exe
- %APPDATA%\subdir\s.exe
Sets the 'hidden' attribute to the following files
- %ProgramFiles%\s\s.exe
- %APPDATA%\subdir\s.exe
Deletes the following files
- %TEMP%\res2.tmp
- %TEMP%\csc1.tmp
- %TEMP%\axhiu02l.out
- %TEMP%\axhiu02l.dll
- %TEMP%\axhiu02l.cmdline
- %TEMP%\axhiu02l.0.cs
- %TEMP%\res4.tmp
- %TEMP%\csc3.tmp
- %TEMP%\mwqvpzvd.0.cs
- %TEMP%\mwqvpzvd.out
- %TEMP%\mwqvpzvd.dll
- %TEMP%\mwqvpzvd.cmdline
- %TEMP%\og.exe
Substitutes the following files
- %TEMP%\og.exe
Network activity
UDP
- DNS ASK ip##pi.com
- DNS ASK pt###p.mypi.co
- DNS ASK my######tblock.001www.com
- DNS ASK fr###eoip.net
- DNS ASK ap#.#pify.org
Miscellaneous
Creates and executes the following
- '%TEMP%\99fcid2wzn1o9aalhva7iw4mmddlapnv..exe'
- '%TEMP%\qv55bmwoelrznhnphvpyrvnraag74ano..exe'
- '%TEMP%\sqhw5uoz2dadyburjqfn2sw4m5tspjjq..exe'
- '%TEMP%\vsdyis5hsvd8tekrfagsqooywcdfxgej..exe'
- '%TEMP%\is-ohr6n.tmp\vsdyis5hsvd8tekrfagsqooywcdfxgej..tmp' /SL5="$A013E,14369288,267776,%TEMP%\VSDYIS5HSVD8TEKRFAGSQOOYWCDFXGEJ..EXE"
- '<SYSTEM32>\windowsinput.exe' --install
- '<SYSTEM32>\windowsinput.exe'
- '%ProgramFiles%\s\s.exe'
- '%APPDATA%\subdir\s.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\axhiu02l.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "%TEMP%\CSC1.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\mwqvpzvd.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4.tmp" "%TEMP%\CSC3.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\axhiu02l.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "%TEMP%\CSC1.tmp"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\mwqvpzvd.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4.tmp" "%TEMP%\CSC3.tmp"
- '<SYSTEM32>\schtasks.exe' /create /tn "w" /sc ONLOGON /tr "%TEMP%\QV55BMWOELRZNHNPHVPYRVNRAAG74ANO..EXE" /rl HIGHEST /f
