Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ProtegentService' = '"<Full path to file>"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ProtegentService' = '"%ProgramFiles(x86)%\Protegent\main.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\protegentservice
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\protegent\main.exe
- %TEMP%\y2jslfpchiim.bat
- %TEMP%\jocmam6sby23.bat
- %TEMP%\ldbpcf8u5qco.bat
- %TEMP%\htou2ch8khdr.bat
- %TEMP%\shuez7rlm5ek.bat
- %TEMP%\y4naqkmd5f3x.bat
- %TEMP%\cbhwksvnpcny.bat
- %TEMP%\vf3y0hyh0tjd.bat
- %TEMP%\d6xcqeyxlq91.bat
- %TEMP%\esocgigg5x08.bat
- %TEMP%\h3tobu69roux.bat
- %TEMP%\cqpy4tnyuehu.bat
- %TEMP%\cqk5oiqmvbqh.bat
- %TEMP%\3zvh2k5r6ykf.bat
- nul
- %TEMP%\pimu6ajo3fta.bat
- %TEMP%\l64cqlvlhvir.bat
- %TEMP%\du9stkas6ml9.bat
Deletes the following files
- %ProgramFiles(x86)%\protegent\main.exe
Substitutes the following files
- %ProgramFiles(x86)%\protegent\main.exe
Network activity
TCP
HTTP GET requests
- http://ip##pi.com/json/
UDP
- DNS ASK ip##pi.com
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\protegent\main.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\T1LLiYOAbyfk.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\tD10Wn04sSFg.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\DU9STkas6ML9.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\y2jsLfpCHIIm.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\Vf3Y0hYh0tjD.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\jocmam6SbY23.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\lDbPcf8U5QCo.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\Htou2Ch8khdr.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\SHUEZ7rLM5Ek.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\Y4NAQkMD5f3x.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\cBhWksvNPCNY.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\D6xCQeYxlQ91.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\L64cqLVlhvIr.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\ESOCGigG5x08.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\H3TObU69ROuX.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\CQpY4tnYuehU.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\cQk5OIqMvBQH.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\3Zvh2k5R6YkF.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\PiMu6ajO3Fta.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\nmTX2zkeUxQu.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\m33TWcdKOAmm.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "ProtegentService" /sc ONLOGON /tr "<Full path to file>" /rl HIGHEST /f
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\T1LLiYOAbyfk.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\tD10Wn04sSFg.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\DU9STkas6ML9.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\y2jsLfpCHIIm.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\Vf3Y0hYh0tjD.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\jocmam6SbY23.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\lDbPcf8U5QCo.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\Htou2Ch8khdr.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\SHUEZ7rLM5Ek.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\Y4NAQkMD5f3x.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\nmTX2zkeUxQu.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\cBhWksvNPCNY.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\L64cqLVlhvIr.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\ESOCGigG5x08.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\H3TObU69ROuX.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\CQpY4tnYuehU.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\cQk5OIqMvBQH.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\3Zvh2k5R6YkF.bat" "
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "ProtegentService" /sc ONLOGON /tr "%ProgramFiles(x86)%\Protegent\main.exe" /rl HIGHEST /f
- '%WINDIR%\syswow64\ping.exe' -n 10 localhost
- '%WINDIR%\syswow64\chcp.com' 65001
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\PiMu6ajO3Fta.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\D6xCQeYxlQ91.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\m33TWcdKOAmm.bat" "
