Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'UserInit' = 'userinit.exe,%WINDIR%\apocalyps32.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'apocalyps32' = '%WINDIR%\apocalyps32.exe'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\split.avi
Modifies file system
Creates the following files
- %TEMP%\unpacked.exe
- %WINDIR%\apocalyps32.exe
- %WINDIR%\ap0calypse_4407f1b7\serverlogs\user\13-03-2020
Network activity
Connects to
- 'localhost':1453
UDP
- DNS ASK wa####n.no-ip.biz
Miscellaneous
Creates and executes the following
- '%TEMP%\unpacked.exe'
- '%WINDIR%\apocalyps32.exe'
Executes the following
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe'
