Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'qhjhfhlpk' = '"%APPDATA%\qhjhfhlpk.txt"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'qhjhfhlpk' = '"%APPDATA%\qhjhfhlpk.txt"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'plugins' = '"%ProgramFiles%\Java\jre1.8.0_45\bin\javaw.exe" -jar "%APPDATA%\plugins.jar" mp'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'plugins' = '"%ProgramFiles%\Java\jre1.8.0_45\bin\javaw.exe" -jar "%APPDATA%\plugins.jar" mp'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\qhjhfhlpk.txt
- <SYSTEM32>\tasks\skype
Modifies file system
Creates the following files
- %APPDATA%\qhjhfhlpk.txt
- %HOMEPATH%\lib\jna-5.5.0.jard
- %HOMEPATH%\lib\jna-platform-5.5.0.jard
- %HOMEPATH%\lib\sqlite-jdbc-3.14.2.1.jard
- %HOMEPATH%\lib\system-hook-3.5.jard
- %HOMEPATH%\qhjhfhlpk.txt
- %TEMP%\jna-3599307\jna9165606998974410736.dll
- %APPDATA%\lib\jna-5.5.0.jar
- %APPDATA%\lib\jna-platform-5.5.0.jar
- %APPDATA%\lib\sqlite-jdbc-3.14.2.1.jar
- %APPDATA%\lib\system-hook-3.5.jar
- %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\qhjhfhlpk.txt
- %TEMP%\jna-3599307\jna4186573432146066844.dll
- %APPDATA%\plugins.jar
- %TEMP%\jna-3599307\jna5695472256492659369.dll
Deletes the following files
- %TEMP%\jna-3599307\jna9165606998974410736.dll
- %TEMP%\jna-3599307\jna4186573432146066844.dll
- %TEMP%\jna-3599307\jna5695472256492659369.dll
Moves the following files
- from %HOMEPATH%\lib\jna-5.5.0.jard to %HOMEPATH%\lib\jna-5.5.0.jar
- from %HOMEPATH%\lib\jna-platform-5.5.0.jard to %HOMEPATH%\lib\jna-platform-5.5.0.jar
- from %HOMEPATH%\lib\system-hook-3.5.jard to %HOMEPATH%\lib\system-hook-3.5.jar
- from %HOMEPATH%\lib\sqlite-jdbc-3.14.2.1.jard to %HOMEPATH%\lib\sqlite-jdbc-3.14.2.1.jar
Network activity
TCP
HTTP GET requests
- http://jb###st.live/strigoi/server/?hw###############
- http://ip##pi.com/json/
UDP
- DNS ASK re###.maven.org
- DNS ASK gi##ub.com
- DNS ASK gi#############on-release-asset-2e65be.s3.amazonaws.com
- DNS ASK st###aster.pw
- DNS ASK jb###st.live
- DNS ASK pa###bin.com
- DNS ASK ip##pi.com
Miscellaneous
Executes the following
- '%ProgramFiles%\java\jre1.8.0_45\bin\javaw.exe' -jar "%APPDATA%\qhjhfhlpk.txt"
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%ProgramFiles%\java\jre1.8.0_45\...
- '%ProgramFiles%\java\jre1.8.0_45\bin\java.exe' -jar "%HOMEPATH%\qhjhfhlpk.txt"
- '<SYSTEM32>\cmd.exe' /c schtasks /create /sc minute /mo 30 /tn Skype /tr "%APPDATA%\qhjhfhlpk.txt"
- '%ProgramFiles%\java\jre1.8.0_45\bin\java.exe' -jar "%APPDATA%\qhjhfhlpk.txt"
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 30 /tn Skype /tr "%APPDATA%\qhjhfhlpk.txt"
- '%ProgramFiles%\java\jre1.8.0_45\bin\java.exe' -jar "%APPDATA%\plugins.jar" mp
- '<SYSTEM32>\cmd.exe' /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"
- '<SYSTEM32>\wbem\wmic.exe' /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list
- '<SYSTEM32>\cmd.exe' /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"
- '<SYSTEM32>\wbem\wmic.exe' /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list
- '<SYSTEM32>\cmd.exe' /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"
- '<SYSTEM32>\wbem\wmic.exe' /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list
- '<SYSTEM32>\cmd.exe' /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list"
- '<SYSTEM32>\wbem\wmic.exe' /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list
