Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'kissq' = '%TEMP%\kissq.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\mui\l
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Modifies file system
Creates the following files
- %APPDATA%\microsoft\launcher.exe
- %TEMP%\temp\wyfdgguu.exe
- <Current directory>\d
- <Current directory>\d-shm
- %TEMP%\temp\jieolll.exe
- %TEMP%\jfiag_gg.exe
- %TEMP%\fjgha23_fa.txt
- %TEMP%\kissq.exe
- %TEMP%\temp\id1.exe
- <Current directory>\config.ini
- <Current directory>\logo.gif
- %LOCALAPPDATA%\google\chrome\userda~1\default\login data.bak
- %APPDATA%\mozilla\firefox\profiles\gn7ryp~1.def\cookies.sqlite-shm
- %TEMP%\temp\videoplay.exe
Deletes the following files
- <Current directory>\d
- <Current directory>\d-shm
Substitutes the following files
- <Current directory>\d
Network activity
TCP
HTTP GET requests
- http://me#####wnloader25.tk/click.php?cn######
- http://ip###ger.org/15Cge7
- http://at#####kyday0003.top/down/id1.exe
- http://ip###ger.org/15Snr7
- http://gf####.2ihsfa.com/api/fbtime
- http://ip##pi.com/json/
- http://jo####.jfoaigh.com/uue/jieolll.exe
- http://www.ge####dvideo.com/vdp1048/videoplay.exe
- http://me#####wnloader25.tk/click.php?cn######################
- http://ip###ger.org/1zdL97
- http://10#.#1.210.187/inb.txt
- http://www.ki###cture.pw/pit/wyfdgguu.exe
- http://os##oft.com/20190118/things.xml
- http://ip##pi.com/xml
- http://ip###ger.org/1Wnwe7
- http://os##oft.com/20190118/rates.xml
- http://www.ge####dvideo.com/video.exe
HTTP POST requests
- http://go#####analytics.com/collect
- http://fr####video.cloud/business/receive
UDP
- DNS ASK me#####wnloader25.tk
- DNS ASK ip###ger.org
- DNS ASK ip##pi.com
- DNS ASK go#####analytics.com
- DNS ASK os##oft.com
- DNS ASK ki###cture.pw
- DNS ASK jo####.jfoaigh.com
- DNS ASK gf####.2ihsfa.com
- DNS ASK at#####kyday0003.top
- DNS ASK fr####video.cloud
- DNS ASK ge####dvideo.com
Miscellaneous
Creates and executes the following
- '%TEMP%\temp\wyfdgguu.exe'
- '%TEMP%\temp\jieolll.exe' /subid=450
- '%TEMP%\jfiag_gg.exe' /scookiestxt %TEMP%\fjgha23_fa.txt
- '%TEMP%\temp\id1.exe'
- '%TEMP%\temp\videoplay.exe' /S /uid=1048
- '%TEMP%\jfiag_gg.exe' /scookiestxt %TEMP%\fjgha23_fa.txt' (with hidden window)
