Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, %APPDATA%\flextime\flextime.exe'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, %APPDATA%\flextime\flextime.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\system.lnk
- %APPDATA%\microsoft\windows\start menu\programs\startup\73841bccf9132da05dfc15ec38717162162f5af4.lnk
- <SYSTEM32>\tasks\9ef712f22a5a0cc166de697041073561
Modifies file system
Creates the following files
- %APPDATA%\flextime\hpnqoojfk1elyrdtrdfh.exe
- %TEMP%\dclib\fw1400ed0ee6a34b0b561cf386c29735441144b544.dclib
- %TEMP%\dclib\as_c07f7472ed0469e66b90bea3f8afee0ab215080e.dclib
- %TEMP%\dclib\antiwindowsdefender.dclib
- %TEMP%\dclib\al6cf54c5afe698333513f91b6a461a8fe412e5694.dclib
- %TEMP%\dclib\ak_33db8088017dd3ba0d1f7d0d6d211cb82b9f06dd.dclib
- %TEMP%\dclib\5d28224fb0abae80e07db6b08e58b07ea9eb5238.dclib
- %APPDATA%\flextime\73841bccf9132da05dfc15ec38717162162f5af4.lnk
- %APPDATA%\flextime\system.lnk
- %APPDATA%\flextime\system.vbe
- %APPDATA%\flextime\flextime.exe
- %APPDATA%\flextime\vmcheck32.dll
- %TEMP%\dclib\pluginsmanager.dclib
- %APPDATA%\flextime\drr1x7ktce936guhyiprnr0pwhyndk.bat
- %APPDATA%\flextime\e6ee5674bb9446c78bbc5729af6e2c28.exe
- %APPDATA%\flextime\dclib\rs2300f068121707def35df4f7b5d2bc8a016bd37f.dclib
- %APPDATA%\flextime\dclib\pluginsmanager.dclib
- %APPDATA%\flextime\dclib\fw1400ed0ee6a34b0b561cf386c29735441144b544.dclib
- %APPDATA%\flextime\dclib\as_c07f7472ed0469e66b90bea3f8afee0ab215080e.dclib
- %APPDATA%\flextime\dclib\antiwindowsdefender.dclib
- %APPDATA%\flextime\dclib\al6cf54c5afe698333513f91b6a461a8fe412e5694.dclib
- %APPDATA%\flextime\dclib\ak_33db8088017dd3ba0d1f7d0d6d211cb82b9f06dd.dclib
- %APPDATA%\flextime\dclib\5d28224fb0abae80e07db6b08e58b07ea9eb5238.dclib
- %APPDATA%\flextime\eme0fi3cmwkbnzemiqv5w8vkrsni8v.bat
- %APPDATA%\flextime\obc31waa4htvnsl31bf3yzrlnsdbra.vbs
- %APPDATA%\flextime\2e62f654bcdde139d74282f5fd2a531696cae5cf
- %TEMP%\dclib\rs2300f068121707def35df4f7b5d2bc8a016bd37f.dclib
Network activity
TCP
HTTP GET requests
- http://62.##9.21.187/gakjeandrmque5ud4dtb8zrri0eyyyr4p3an9fi45xn/8nz79uo9bbjoet2gwykbqs/7a52781f290775a759de5f5f2cd606418fc9387e.php?3b################################
- http://62.##9.21.187/gakjeandrmque5ud4dtb8zrri0eyyyr4p3an9fi45xn/8nz79uo9bbjoet2gwykbqs/7a52781f290775a759de5f5f2cd606418fc9387e.php?6e##########################################################...
- http://62.##9.21.187/gakjeandrmque5ud4dtb8zrri0eyyyr4p3an9fi45xn/8nz79uo9bbjoet2gwykbqs/q0prhiiiucl2kowd40o4fka60ex4nvi94d95tc11/1a6bb5dc81d284de29a6f852eb25c645.php?fc#########################...
- http://ip##fo.io/ip
- http://62.##9.21.187/proxy.txt
UDP
- DNS ASK ip##fo.io
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\flextime\oBc31Waa4htvnsL31bf3yzrLnsDbRa.vbs"
- '%APPDATA%\flextime\hpnqoojfk1elyrdtrdfh.exe' -p46714aa5617695e533a8cce66e27b29c242a855c
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\flextime\System.vbe"
- '%APPDATA%\flextime\e6ee5674bb9446c78bbc5729af6e2c28.exe'
- '%APPDATA%\flextime\flextime.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\flextime\eMe0FI3CMwkbnZeMIQV5W8VKrSni8V.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\flextime\drr1X7KTcE936gUHYIPrnR0pwHYnDK.bat" "' (with hidden window)
- '%APPDATA%\flextime\e6ee5674bb9446c78bbc5729af6e2c28.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\flextime\eMe0FI3CMwkbnZeMIQV5W8VKrSni8V.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\flextime\drr1X7KTcE936gUHYIPrnR0pwHYnDK.bat" "
