Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\task5h3dku8
- <SYSTEM32>\tasks\system cache service
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- C:\users\public\winlogon.exe
- C:\users\public\stsk.exe
- C:\users\public\studio.exe
- %PROGRAMDATA%\аварн.exe
- %APPDATA%\cashcore\аварн.exe
Deletes the following files
- C:\users\public\stsk.exe
Network activity
TCP
HTTP GET requests
- http://kr###bs.online/upd/support.php
- http://kr###bs.online/WebPanel/db_proc.php/?fu######################################
UDP
- DNS ASK kr###bs.online
Miscellaneous
Creates and executes the following
- 'C:\users\public\stsk.exe' /create /tn "Task5H3DKU8" /tr C:\Users\Public\winlogon.exe /sc onlogon
- 'C:\users\public\studio.exe'
- '%PROGRAMDATA%\аварн.exe'
- '%APPDATA%\cashcore\аварн.exe'
- 'C:\users\public\stsk.exe' /create /tn "Task5H3DKU8" /tr C:\Users\Public\winlogon.exe /sc onlogon' (with hidden window)
- '%PROGRAMDATA%\аварн.exe' ' (with hidden window)
- '<SYSTEM32>\svchost.exe' ' (with hidden window)
- '%APPDATA%\cashcore\аварн.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\svchost.exe'
