Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe,EXPORT_SV.EXE'
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /im SSK_ASSETEXPORT.exe /f
- '%WINDIR%\syswow64\taskkill.exe' /im EXPORT_SV.exe /f
- '%WINDIR%\syswow64\taskkill.exe' /im EXPORT_ST.exe /f
Modifies file system
Creates the following files
- %TEMP%\nsce363.tmp\nsexec.dll
- C:\ssk\ssk_export\sskitexp.dll
- C:\ssk\ssk_export\sskitexp.pdb
- C:\ssk\ssk_export\sskitexp.xml
- C:\ssk\ssk_export\ssk_assetexport.exe
- C:\ssk\ssk_export\ko\newassetexport.resources.dll
- C:\ssk\ssk_export\vi\newassetexport.resources.dll
- C:\ssk\ssk_export\zh\newassetexport.resources.dll
- %TEMP%\nsce363.tmp\system.dll
- <SYSTEM32>\bunifu_ui_v1.52.dll
- <SYSTEM32>\export_sv.exe
- <SYSTEM32>\export_sv_new.exe
- <SYSTEM32>\export_sv_new.exe.config
- <SYSTEM32>\export_sv_new.pdb
- <SYSTEM32>\export_sv_new.xml
- <SYSTEM32>\newtonsoft.json.dll
- <SYSTEM32>\newtonsoft.json.xml
- <SYSTEM32>\ko\export_sv_new.resources.dll
- <SYSTEM32>\vi\export_sv_new.resources.dll
- <SYSTEM32>\zh\export_sv_new.resources.dll
- C:\ssk\ssk_export\sskitexp.xmlserializers.dll
- C:\users\public\desktop\ssk_export.lnk
- C:\ssk\ssk_export\regexport.xml
- C:\ssk\ssk_export\regexport.exe
- C:\ssk\ssk_export\bunifu.core.dll
- C:\ssk\ssk_export\bunifu.ui.winforms.bunifubutton.dll
- C:\ssk\ssk_export\bunifu.ui.winforms.bunifuformdock.dll
- C:\ssk\ssk_export\bunifu.ui.winforms.bunifuimagebutton.dll
- C:\ssk\ssk_export\bunifu.ui.winforms.bunifulabel.dll
- C:\ssk\ssk_export\bunifu.ui.winforms.bunifupicturebox.dll
- C:\ssk\ssk_export\bunifu.ui.winforms.bunifuradiobutton.dll
- C:\ssk\ssk_export\bunifu.ui.winforms.bunifutextbox.dll
- C:\ssk\ssk_export\bunifu_ui_v1.5.3.dll
- C:\ssk\ssk_export\bunifu_ui_v1.52.dll
- C:\ssk\ssk_export\export_st.exe
- C:\ssk\ssk_export\metroframework.fonts.dll
- C:\ssk\ssk_export\metroframework.dll
- C:\ssk\ssk_export\newassetexport.exe
- C:\ssk\ssk_export\newassetexport.exe.config
- C:\ssk\ssk_export\newassetexport.pdb
- C:\ssk\ssk_export\newassetexport.xml
- C:\ssk\ssk_export\newtonsoft.json.dll
- C:\ssk\ssk_export\newtonsoft.json.xml
- C:\ssk\ssk_export\regexport.pdb
- C:\users\default\desktop\ssk_export.lnk
Deletes the following files
- %TEMP%\nsce363.tmp\nsexec.dll
- %TEMP%\nsce363.tmp\system.dll
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\export_sv.exe'
- 'C:\ssk\ssk_export\regexport.exe' 1
- '%WINDIR%\syswow64\taskkill.exe' /im SSK_ASSETEXPORT.exe /f' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /im EXPORT_SV.exe /f' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /im EXPORT_ST.exe /f' (with hidden window)
- 'C:\ssk\ssk_export\regexport.exe' 1' (with hidden window)
