Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\desktop.it.lnk
- %APPDATA%\microsoft\windows\start menu\programs\startup\desktop.ini.lnk
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /im cmd.exe
- '%WINDIR%\syswow64\taskkill.exe' /IM svchost.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /IM gcc-win32.exe
- '%WINDIR%\syswow64\taskkill.exe' /IM odbcad32.exe
Downloads
- https://pastebin.com/raw/k5kjv728
Modifies file system
Creates the following files
- %APPDATA%\system32\mmc.exe
- <LS_APPDATA>\system32\test.test
- %APPDATA%\system32\exitg.vbs
- %APPDATA%\system32\startgc.cmd
- %APPDATA%\system32\gcc-win32.exe
- %APPDATA%\system32\updatessm.vbs
- %APPDATA%\system32\updatemssm.vbs
- %APPDATA%\system32\startupdate.cmd
- %APPDATA%\system32\config.json
- %APPDATA%\system32\startmupdate.cmd
- <LS_APPDATA>\system32\startps.bat
- <LS_APPDATA>\system32\ps.ps1
- <LS_APPDATA>\system32\pcmd.vbs
- <LS_APPDATA>\system32\hostd.vbs
- <LS_APPDATA>\system32\svhost.bat
- <LS_APPDATA>\system32\hps.vbs
- %APPDATA%\system32\odbcad32.exe
- <LS_APPDATA>\system32\kmsauto net.exe
- %APPDATA%\system32\svchost.exe
Deletes the following files
- <LS_APPDATA>\system32\test.test
Network activity
UDP
- DNS ASK xm#####.nanopool.org
- DNS ASK pa###bin.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%APPDATA%\system32\mmc.exe' -p123
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\system32\updatessm.vbs"
- '%APPDATA%\system32\gcc-win32.exe' -p123
- '%WINDIR%\syswow64\wscript.exe' "<LS_APPDATA>\system32\hps.vbs" -ExecutionPolicy ByPass -File "<LS_APPDATA>\system32\ps.ps1"
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\system32\updatemssm.vbs"
- '%WINDIR%\syswow64\wscript.exe' "<LS_APPDATA>\system32\pcmd.vbs"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy ByPass -File <LS_APPDATA>\system32\ps.ps1
- '%APPDATA%\system32\odbcad32.exe'
- '<LS_APPDATA>\system32\kmsauto net.exe'
- '%WINDIR%\syswow64\wscript.exe' "<LS_APPDATA>\system32\hostd.vbs"
- '%APPDATA%\system32\svchost.exe'
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\system32\exitg.vbs"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy ByPass -File <LS_APPDATA>\system32\ps.ps1' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c startmupdate.cmd' (with hidden window)
- '<SYSTEM32>\cmd.exe' /D /c del /F /Q "test.test"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c startgc.cmd' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c startps.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c svhost.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c startupdate.cmd' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c echo test>>"<LS_APPDATA>\system32\test.test"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c echo test>>"<LS_APPDATA>\system32\test.test"
- '%WINDIR%\syswow64\cmd.exe' /c Taskkill /im cmd.exe
- '<SYSTEM32>\cmd.exe' /D /c del /F /Q "test.test"
- '%WINDIR%\syswow64\cmd.exe' /c startps.bat
- '%WINDIR%\syswow64\cmd.exe' /c svhost.bat
- '%WINDIR%\syswow64\cmd.exe' /c startupdate.cmd
- '%WINDIR%\syswow64\cmd.exe' /c startmupdate.cmd
- '%WINDIR%\syswow64\cmd.exe' /c startgc.cmd
