Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /im "<File name>.exe" /f
- '%WINDIR%\syswow64\taskkill.exe' /im "5t5o58Ysq5=.exe" /f
Searches for windows to
detect analytical utilities:
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
Modifies file system
Creates the following files
- <Current directory>\5t5o58ysq5=.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %TEMP%\2886080068.exe
- %TEMP%\4386156493.exe
Deletes the following files
- <Current directory>\5t5o58ysq5=.exe
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://yo#####4kdowloader.club/version
- http://yo###be4kd.xyz/source2.cfg
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://ip###ger.org/1asSq7
- http://yo#####4kdowloader.club/bin/ProgressLoader.exe
UDP
- DNS ASK yo#####4kdowloader.club
- DNS ASK yo###be4kd.xyz
- DNS ASK ip###ger.org
- DNS ASK ra#.####ubusercontent.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
Creates and executes the following
- '<Current directory>\5t5o58ysq5=.exe'
- '%TEMP%\2886080068.exe'
- '%TEMP%\4386156493.exe'
- '%WINDIR%\syswow64\cmd.exe' /c start /I "" "<Current directory>\5t5o58Ysq5=.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "<File name>.exe" /f & erase "<Full path to file>" & exit' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c start /I "" "%TEMP%\2886080068.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c start /I "" "%TEMP%\4386156493.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "5t5o58Ysq5=.exe" /f & erase "<Current directory>\5t5o58Ysq5=.exe" & exit' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c start /I "" "<Current directory>\5t5o58Ysq5=.exe"
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "<File name>.exe" /f & erase "<Full path to file>" & exit
- '%WINDIR%\syswow64\cmd.exe' /c start /I "" "%TEMP%\2886080068.exe"
- '%WINDIR%\syswow64\cmd.exe' /c start /I "" "%TEMP%\4386156493.exe"
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "5t5o58Ysq5=.exe" /f & erase "<Current directory>\5t5o58Ysq5=.exe" & exit
