Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\KITSvc] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\KITSvc] 'ImagePath' = '"<SYSTEM32>\KITSvc\KITSvc.exe"'
Malicious functions
Executes the following
- '<SYSTEM32>\net.exe' stop "KITSvc"
Modifies file system
Creates the following files
- %TEMP%\is-1k7ke.tmp\<File name>.tmp
- <SYSTEM32>\kitsvc\system\loaderexecutables\x86\is-nq0fp.tmp
- <SYSTEM32>\kitsvc\system\loadermodules\is-2meuk.tmp
- <SYSTEM32>\kitsvc\system\loadermodules\is-0u5g3.tmp
- <SYSTEM32>\kitsvc\system\loadermodules\is-8j5bm.tmp
- <SYSTEM32>\kitsvc\system\loadermodules\is-ogoaq.tmp
- <SYSTEM32>\kitsvc\system\loadermodules\is-l91gm.tmp
- <SYSTEM32>\kitsvc\system\loadermodules\is-vab1c.tmp
- <SYSTEM32>\kitsvc\system\loadermodules\is-njcl0.tmp
- <SYSTEM32>\kitsvc\system\loaderexecutables\is-lp2dl.tmp
- <SYSTEM32>\kitsvc\system\loaderexecutables\x64\is-o7ksf.tmp
- <SYSTEM32>\kitsvc\system\loadermodules\is-5lmog.tmp
- <SYSTEM32>\kitsvc\system\loadermodules\is-vtig8.tmp
- <SYSTEM32>\kitsvc\system\loadermodules\is-02qfm.tmp
- <SYSTEM32>\kitsvc\system\loadermodules\is-87ef3.tmp
- <SYSTEM32>\unins000.msg
- <SYSTEM32>\unins000.dat
- <SYSTEM32>\kitsvc\installutil.installlog
- <SYSTEM32>\kitsvc\kitsvc.installlog
- <SYSTEM32>\kitsvc\kitsvc.installstate
- <SYSTEM32>\kitsvc\system\loadermodules\is-ajrg8.tmp
- <SYSTEM32>\kitsvc\system\loadermodules\is-olm67.tmp
- <SYSTEM32>\kitsvc\system\loaderexecutables\is-aoecb.tmp
- <SYSTEM32>\kitsvc\system\loaderconfigs\firstlaunchmodule.cfg
- <SYSTEM32>\kitsvc\system\loaderconfigs\is-avkjl.tmp
- <SYSTEM32>\services.cfg
- <SYSTEM32>\is-f1kkg.tmp
- <SYSTEM32>\kitsvc\is-iuo44.tmp
- <SYSTEM32>\kitsvc\is-h09hk.tmp
- <SYSTEM32>\kitsvc\config\is-ev8ha.tmp
- <SYSTEM32>\kitsvc\executables\is-jiit1.tmp
- <SYSTEM32>\kitsvc\executables\is-52rpr.tmp
- <SYSTEM32>\kitsvc\executables\x64\is-scpl6.tmp
- <SYSTEM32>\kitsvc\executables\x64\is-0cdm2.tmp
- %TEMP%\is-r5pbb.tmp\<File name>.tmp
- <SYSTEM32>\kitsvc\executables\x86\is-sgjjp.tmp
- <SYSTEM32>\kitsvc\system\is-3f7rq.tmp
- <SYSTEM32>\kitsvc\system\is-ekrq7.tmp
- <SYSTEM32>\kitsvc\system\is-katnf.tmp
- <SYSTEM32>\kitsvc\system\is-d8642.tmp
- <SYSTEM32>\kitsvc\system\is-l7i68.tmp
- <SYSTEM32>\kitsvc\system\is-fh11g.tmp
- <SYSTEM32>\kitsvc\system\is-lnfqs.tmp
- <SYSTEM32>\kitsvc\system\is-c4og2.tmp
- <SYSTEM32>\kitsvc\system\heartbeatconfigs\is-a6599.tmp
- <SYSTEM32>\kitsvc\executables\x86\is-1526i.tmp
- <SYSTEM32>\kitsvc\config\deviceid.cfg
- %TEMP%\selfdelete2.bat
Deletes the following files
- %TEMP%\is-1k7ke.tmp\<File name>.tmp
- %TEMP%\is-r5pbb.tmp\<File name>.tmp
Moves the following files
- from <SYSTEM32>\is-f1kkg.tmp to <SYSTEM32>\unins000.exe
- from <SYSTEM32>\kitsvc\system\loaderexecutables\is-aoecb.tmp to <SYSTEM32>\kitsvc\system\loaderexecutables\xbrowserconfigchecker.exe
- from <SYSTEM32>\kitsvc\system\loaderexecutables\is-lp2dl.tmp to <SYSTEM32>\kitsvc\system\loaderexecutables\xloaderauto.exe
- from <SYSTEM32>\kitsvc\system\loaderexecutables\x64\is-o7ksf.tmp to <SYSTEM32>\kitsvc\system\loaderexecutables\x64\sqlite.interop.dll
- from <SYSTEM32>\kitsvc\system\loaderexecutables\x86\is-nq0fp.tmp to <SYSTEM32>\kitsvc\system\loaderexecutables\x86\sqlite.interop.dll
- from <SYSTEM32>\kitsvc\system\loadermodules\is-2meuk.tmp to <SYSTEM32>\kitsvc\system\loadermodules\algorithmcommand.dll
- from <SYSTEM32>\kitsvc\system\loadermodules\is-0u5g3.tmp to <SYSTEM32>\kitsvc\system\loadermodules\collectcommand.dll
- from <SYSTEM32>\kitsvc\system\loadermodules\is-8j5bm.tmp to <SYSTEM32>\kitsvc\system\loadermodules\constantsmodule.dll
- from <SYSTEM32>\kitsvc\system\loadermodules\is-ogoaq.tmp to <SYSTEM32>\kitsvc\system\loadermodules\deletecommand.dll
- from <SYSTEM32>\kitsvc\system\loadermodules\is-l91gm.tmp to <SYSTEM32>\kitsvc\system\loadermodules\downloadcommand.dll
- from <SYSTEM32>\kitsvc\system\loadermodules\is-vab1c.tmp to <SYSTEM32>\kitsvc\system\loadermodules\firstlaunchmodule.dll
- from <SYSTEM32>\kitsvc\system\loadermodules\is-njcl0.tmp to <SYSTEM32>\kitsvc\system\loadermodules\heartbeatcommand.dll
- from <SYSTEM32>\kitsvc\system\loadermodules\is-5lmog.tmp to <SYSTEM32>\kitsvc\system\loadermodules\loadercommand.dll
- from <SYSTEM32>\kitsvc\system\loadermodules\is-ajrg8.tmp to <SYSTEM32>\kitsvc\system\loadermodules\runcommand.dll
- from <SYSTEM32>\kitsvc\system\loadermodules\is-olm67.tmp to <SYSTEM32>\kitsvc\system\loadermodules\selfupdatecommand.dll
- from <SYSTEM32>\kitsvc\system\loadermodules\is-vtig8.tmp to <SYSTEM32>\kitsvc\system\loadermodules\servicecommand.dll
- from <SYSTEM32>\kitsvc\system\loaderconfigs\is-avkjl.tmp to <SYSTEM32>\kitsvc\system\loaderconfigs\firstlaunchmodule.cfg
- from <SYSTEM32>\kitsvc\system\loadermodules\is-02qfm.tmp to <SYSTEM32>\kitsvc\system\loadermodules\systemcommand.dll
- from <SYSTEM32>\kitsvc\system\heartbeatconfigs\is-a6599.tmp to <SYSTEM32>\kitsvc\system\heartbeatconfigs\heartbeathash.cfg
- from <SYSTEM32>\kitsvc\system\is-lnfqs.tmp to <SYSTEM32>\kitsvc\system\xreversesocks5proxycore.dll
- from <SYSTEM32>\kitsvc\is-iuo44.tmp to <SYSTEM32>\kitsvc\xsystemcore.dll
- from <SYSTEM32>\kitsvc\is-h09hk.tmp to <SYSTEM32>\kitsvc\kitsvc.exe
- from <SYSTEM32>\kitsvc\config\is-ev8ha.tmp to <SYSTEM32>\kitsvc\config\urls.cfg
- from <SYSTEM32>\kitsvc\executables\is-jiit1.tmp to <SYSTEM32>\kitsvc\executables\chromedriver.exe
- from <SYSTEM32>\kitsvc\executables\is-52rpr.tmp to <SYSTEM32>\kitsvc\executables\microsoftwebdriver.exe
- from <SYSTEM32>\kitsvc\executables\x64\is-scpl6.tmp to <SYSTEM32>\kitsvc\executables\x64\geckodriver.exe
- from <SYSTEM32>\kitsvc\executables\x64\is-0cdm2.tmp to <SYSTEM32>\kitsvc\executables\x64\operadriver.exe
- from <SYSTEM32>\kitsvc\executables\x86\is-sgjjp.tmp to <SYSTEM32>\kitsvc\executables\x86\geckodriver.exe
- from <SYSTEM32>\kitsvc\executables\x86\is-1526i.tmp to <SYSTEM32>\kitsvc\executables\x86\operadriver.exe
- from <SYSTEM32>\kitsvc\system\is-3f7rq.tmp to <SYSTEM32>\kitsvc\system\xheartbeat.dll
- from <SYSTEM32>\kitsvc\system\is-ekrq7.tmp to <SYSTEM32>\kitsvc\system\xhider.dll
- from <SYSTEM32>\kitsvc\system\is-katnf.tmp to <SYSTEM32>\kitsvc\system\xloader.dll
- from <SYSTEM32>\kitsvc\system\is-d8642.tmp to <SYSTEM32>\kitsvc\system\xloadercore.dll
- from <SYSTEM32>\kitsvc\system\is-l7i68.tmp to <SYSTEM32>\kitsvc\system\xreverserdp.dll
- from <SYSTEM32>\kitsvc\system\is-fh11g.tmp to <SYSTEM32>\kitsvc\system\xreversesocks5proxy.dll
- from <SYSTEM32>\kitsvc\system\is-c4og2.tmp to <SYSTEM32>\kitsvc\system\xwall.dll
- from <SYSTEM32>\kitsvc\system\loadermodules\is-87ef3.tmp to <SYSTEM32>\kitsvc\system\loadermodules\taskscommand.dll
Deletes itself.
Miscellaneous
Creates and executes the following
- '%TEMP%\is-1k7ke.tmp\<File name>.tmp' /SL5="$800E0,21098250,485888,<Full path to file>"
- '%TEMP%\is-r5pbb.tmp\<File name>.tmp' /SL5="$200AC,21098250,485888,<Full path to file>" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART
- '<SYSTEM32>\kitsvc\kitsvc.exe' --install
- '<SYSTEM32>\kitsvc\kitsvc.exe'
- '<Full path to file>' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART' (with hidden window)
- '<SYSTEM32>\net.exe' stop "KITSvc"' (with hidden window)
- '<SYSTEM32>\kitsvc\kitsvc.exe' --install' (with hidden window)
- '<SYSTEM32>\sc.exe' failure "KITSvc" reset= 0 actions= restart/5000' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C ""%TEMP%\SelfDelete2.bat""' (with hidden window)
Executes the following
- '<SYSTEM32>\net1.exe' stop "KITSvc"
- '<SYSTEM32>\sc.exe' failure "KITSvc" reset= 0 actions= restart/5000
- '<SYSTEM32>\cmd.exe' /C ""%TEMP%\SelfDelete2.bat""
