Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'd3dx32' = '%WINDIR%\System.lnk'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\system.lnk
- %APPDATA%\microsoft\windows\start menu\programs\startup\bkphst32.lnk
- %APPDATA%\microsoft\windows\start menu\programs\startup\winlog.lnk
Modifies file system
Creates the following files
- %WINDIR%\nmi69diqxrkhqsbz8i5v.exe
- %WINDIR%\5r1ntenu7ymduukd6kdsk8jzzv0og9.vbs
- %WINDIR%\w4lznqrwzovdf2pqhg9u2qaxeqtz1p.bat
- %WINDIR%\msg.vbs
- %WINDIR%\mos
- %WINDIR%\1frwsrhgafnjsbtgqmacytumdfv3ks.bat
- %WINDIR%\vmcheck32.dll
- %WINDIR%\cmd.exe
- %WINDIR%\system.vbe
- %WINDIR%\system.lnk
- %HOMEPATH%\pictures\bkphst32.exe
- %HOMEPATH%\pictures\bkphst32.lnk
- %HOMEPATH%\pictures\vmcheck32.dll
- %WINDIR%\winlog.lnk
Network activity
TCP
HTTP GET requests
- http://sd####afghaetg.tk/50x772khp0xt1pa8v92uihck8o0hrpsndkab4mmcwy/h0i6cptesj2pvwutal1zq75oc/08fcc88aac48dbb0e04f023bb03d08fdeeaf0aed.php?da#########
- http://sd####afghaetg.tk/50x772khp0xt1pa8v92uihck8o0hrpsndkab4mmcwy/h0i6cptesj2pvwutal1zq75oc/kvbopep57md372zew5l4/cc7be9c3f752123f8f33d7a841c0c1e6.php?ty#######################################...
- http://sd####afghaetg.tk/50x772khp0xt1pa8v92uihck8o0hrpsndkab4mmcwy/h0i6cptesj2pvwutal1zq75oc/kvbopep57md372zew5l4/e476a6bf5f4fbe3a85bbc65671aa12b612c0074b.2e0bcfd4d2c02806b9835a1f15a00b58
- http://sd####afghaetg.tk/50x772khp0xt1pa8v92uihck8o0hrpsndkab4mmcwy/h0i6cptesj2pvwutal1zq75oc/kvbopep57md372zew5l4/e476a6bf5f4fbe3a85bbc65671aa12b612c0074b.69239eedb42a049168cd5bdcbe165c54
- http://sd####afghaetg.tk/50x772khp0xt1pa8v92uihck8o0hrpsndkab4mmcwy/h0i6cptesj2pvwutal1zq75oc/kvbopep57md372zew5l4/e476a6bf5f4fbe3a85bbc65671aa12b612c0074b.comm
- http://ip##fo.io/ip
UDP
- DNS ASK sd####afghaetg.tk
- DNS ASK ip##fo.io
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%WINDIR%\5R1NtEnu7ymduuKD6KdSk8JZzV0Og9.vbs"
- '%WINDIR%\nmi69diqxrkhqsbz8i5v.exe' -p0ef9f86896832839bbe1d46e82d12595a295f43d
- '%WINDIR%\syswow64\wscript.exe' "%WINDIR%\System.vbe"
- '%WINDIR%\syswow64\wscript.exe' "%WINDIR%\msg.vbs"
- '%WINDIR%\cmd.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\W4LZNQrWZOVDF2PQhG9u2QAXeQTz1p.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\1FrwSrHgAFnjsbtgqMacyTUMdFv3kS.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\W4LZNQrWZOVDF2PQhG9u2QAXeQTz1p.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\1FrwSrHgAFnjsbtgqMacyTUMdFv3kS.bat" "
