Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Adobe QuikInstall' = '%APPDATA%\Adobe\Adobe QuikInstall.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\system.lnk
- %APPDATA%\microsoft\windows\start menu\programs\startup\2096ea3e9e3d0d9a9dcf954c8b77e32e71db53fa.lnk
- %APPDATA%\microsoft\windows\start menu\programs\startup\ba826a04cf6461da88a0dec7d24b699889415e34.lnk
Modifies file system
Creates the following files
- C:\dhcpreview\a18dzrflb8gjgnmng65w.exe
- C:\dhcpreview\jad7ck5wsdtyckt7obypikvtc1ebzv.bat
- C:\dhcpreview\vmcheck32.dll
- C:\dhcpreview\savescommon.exe
- C:\dhcpreview\system.vbe
- C:\dhcpreview\system.lnk
- %HOMEPATH%\pictures\ee11cbb19052e40b07aac0ca060c23ee.exe
- %HOMEPATH%\pictures\2096ea3e9e3d0d9a9dcf954c8b77e32e71db53fa.lnk
- C:\dhcpreview\ba826a04cf6461da88a0dec7d24b699889415e34.lnk
- %APPDATA%\adobe\adobe quikinstall.exe
- %APPDATA%\notepad\media.zip
- %APPDATA%\obsidium\runtime broker.exe
- %APPDATA%\vortex\securityhealthservice.exe
- %APPDATA%\sun\yourphone.exe
- %APPDATA%\obsidium\watchdog.data
- %APPDATA%\vortex\watchdog.data
- %APPDATA%\sun\watchdog.data
- C:\dhcpreview\watchdog.data
- %HOMEPATH%\pictures\vmcheck32.dll
- C:\dhcpreview\starter.exe
- C:\dhcpreview\dclib\as_c07f7472ed0469e66b90bea3f8afee0ab215080e.dclib
- C:\dhcpreview\ojnkauzyxema0yvczqll5ps0e9yudv.vbs
- C:\dhcpreview\zawfjfwyfjfumhrqy1zlxnzgbpmfzh.bat
- C:\dhcpreview\dclib\5d28224fb0abae80e07db6b08e58b07ea9eb5238.dclib
- C:\dhcpreview\dclib\ak_33db8088017dd3ba0d1f7d0d6d211cb82b9f06dd.dclib
- C:\dhcpreview\dclib\al6cf54c5afe698333513f91b6a461a8fe412e5694.dclib
- C:\dhcpreview\dclib\antivm.dclib
- C:\dhcpreview\dclib\antiwindowsdefender.dclib
- C:\dhcpreview\dclib\pluginsmanager.dclib
- C:\dhcpreview\dogs\securityhealthservice.exe
- C:\dhcpreview\dclib\rs2300f068121707def35df4f7b5d2bc8a016bd37f.dclib
- C:\dhcpreview\e6ee5674bb9446c78bbc5729af6e2c28.exe
- C:\dhcpreview\msg.vbs
- C:\dhcpreview\mos
- C:\dhcpreview\2e62f654bcdde139d74282f5fd2a531696cae5cf
- C:\dhcpreview\dogs\adobe quikinstall.exe
- C:\dhcpreview\dogs\runtime broker.exe
- C:\dhcpreview\dogs\yourphone.exe
- %APPDATA%\notepad\system.vbe
Network activity
TCP
HTTP GET requests
- http://ru###ild.hol.es/kpowx2pexjt9n1xm7hnzfun1ck1els8rkmslxag/t3qoah9dtsneu922y3agfb9bkzcp5kwhz47dwffad0ybrww15qxv6jjdzumejlv4/bf31cd95b0b850bc98dd52094095cffd6ec2b953.php?f7##################...
UDP
- DNS ASK ru###ild.hol.es
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "C:\dhcpreview\oJNKauZYxEma0YVCZqll5pS0E9YUdv.vbs"
- 'C:\dhcpreview\starter.exe'
- '%WINDIR%\syswow64\wscript.exe' "C:\dhcpreview\System.vbe"
- '%WINDIR%\syswow64\wscript.exe' "C:\dhcpreview\msg.vbs"
- 'C:\dhcpreview\savescommon.exe'
- 'C:\dhcpreview\a18dzrflb8gjgnmng65w.exe' -p1fb25fbfe6db17f751c0229303a5f0377a94c608
- 'C:\dhcpreview\e6ee5674bb9446c78bbc5729af6e2c28.exe'
- '%APPDATA%\sun\yourphone.exe'
- '%APPDATA%\adobe\adobe quikinstall.exe'
- '%APPDATA%\vortex\securityhealthservice.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\dhcpreview\zaWFjfwYFjFumHrqy1zlxNZGBpMFzh.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C %APPDATA%\Obsidium\Runtime Broker.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C %APPDATA%\Sun\YourPhone.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C %APPDATA%\Vortex\SecurityHealthService.exe' (with hidden window)
- 'C:\dhcpreview\e6ee5674bb9446c78bbc5729af6e2c28.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\dhcpreview\JaD7cK5WSDTyckt7ObYPikvTC1ebZV.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C C:/Media/fontreview.exe' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\dhcpreview\zaWFjfwYFjFumHrqy1zlxNZGBpMFzh.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\dhcpreview\JaD7cK5WSDTyckt7ObYPikvTC1ebZV.bat" "
- '%WINDIR%\syswow64\cmd.exe' /C %APPDATA%\Obsidium\Runtime Broker.exe
- '%WINDIR%\syswow64\cmd.exe' /C %APPDATA%\Vortex\SecurityHealthService.exe
- '%WINDIR%\syswow64\cmd.exe' /C %APPDATA%\Sun\YourPhone.exe
- '%WINDIR%\syswow64\cmd.exe' /C C:/Media/fontreview.exe
