Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\windows\servicerun
Modifies file system
Moves itself
- from <Full path to file> to %PROGRAMDATA%\vshub.exe
Network activity
Connects to
- 'se###hisweb.com':80
UDP
- DNS ASK dr##en.xyz
- DNS ASK se###hisweb.com
Miscellaneous
Searches for the following windows
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\attrib.exe' +s +h "%PROGRAMDATA%\vshub.exe"' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /tn \Windows\ServiceRun /tr "%PROGRAMDATA%\vshub.exe" /st 00:00 /sc daily /du 9999:59 /ri 2 /f' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\attrib.exe' +s +h "%PROGRAMDATA%\vshub.exe"
- '%WINDIR%\syswow64\schtasks.exe' /create /tn \Windows\ServiceRun /tr "%PROGRAMDATA%\vshub.exe" /st 00:00 /sc daily /du 9999:59 /ri 2 /f
