Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'XO1XADpO01' = '"%TEMP%\9FE4.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\nvngxupdatecheckdaily_{6eefbfb0-bfb0-bfb0-bfb0-6eefbfb0bfb0}
Creates the following files on removable media
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\hypothyroidism_slides.pptx
- <Drive name for removable media>:\waterresourcesag.pptx
- <Drive name for removable media>:\stoc13_ml_quoc_le.pptx
- <Drive name for removable media>:\samieee_obiee_presentation.pptx
- <Drive name for removable media>:\applicantform_en.doc
- <Drive name for removable media>:\hanni_umami_chapter.doc
- <Drive name for removable media>:\lisp_success.doc
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\sdksampleprivdeveloper.cer
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\toolbar.bmp
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\archer.avi
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\restore-my-files.txt
- <Drive name for removable media>:\indogerman2010.pptx
- <Drive name for removable media>:\middaugh_keynote.pptx
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\d47f.tmp
- %APPDATA%\vhusivr
- %APPDATA%\rvthuub
- %TEMP%\8df0.exe
- %TEMP%\96cb.exe
- %TEMP%\9fe4.exe
- %TEMP%\a8be.exe
- D:\restore-my-files.txt
- %PROGRAMDATA%\wpjpict\ehbsm.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\vhusivr
- %APPDATA%\rvthuub
Deletes itself.
Changes user data files extensions (Trojan.Encoder).
Network activity
TCP
HTTP GET requests
- http://dg#####exmail19mn.xyz/lkx999.exe
- http://dg#####exmail19mn.xyz/socks777.exe
- http://dg#####exmail19mn.xyz/mtx999.exe
- http://dg#####exmail19mn.xyz/host777.exe
HTTP POST requests
- http://fd###l85.club/statweb77/
- http://ad####xman7.club/statweb77/
UDP
- DNS ASK re###at35.club
- DNS ASK de###ot2.xyz
- DNS ASK at###ot20.xyz
- DNS ASK re###ot7.xyz
- DNS ASK fd###l85.club
- DNS ASK se####em977.club
- DNS ASK ad####xman7.club
- DNS ASK dg#####exmail19mn.xyz
Miscellaneous
Creates and executes the following
- '%TEMP%\8df0.exe'
- '%TEMP%\96cb.exe'
- '%TEMP%\9fe4.exe'
- '%TEMP%\a8be.exe'
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...
