Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\nvngxupdatecheckdaily_{5d7c6d5b-6d5b-6d5b-6d5b-5d7c6d5b6d5b}
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\9a26.tmp
- %APPDATA%\cjehciw
Sets the 'hidden' attribute to the following files
- %APPDATA%\cjehciw
Deletes the following files
- %TEMP%\9a26.tmp
Substitutes the following files
- %TEMP%\9a26.tmp
Deletes itself.
Network activity
Connects to
- 'xi###orn.com':80
- 'ka##uelo.co':80
- 'pi###slel.is':80
- 'da##e.to':80
- '3r##amp.ga':80
- 'th##rd.ml':80
TCP
HTTP POST requests
- http://xi###orn.com/
- http://ka##uelo.co/
- http://pi###slel.is/
- http://da##e.to/
- http://3r##amp.ga/
- http://th##rd.ml/
UDP
- DNS ASK xi###orn.com
- DNS ASK ka##uelo.co
- DNS ASK pi###slel.is
- DNS ASK da##e.to
- DNS ASK 3r##amp.ga
- DNS ASK th##rd.ml
Miscellaneous
Creates and executes the following
- '%APPDATA%\cjehciw'
- '%APPDATA%\cjehciw' ' (with hidden window)
Executes the following
- '<SYSTEM32>\taskeng.exe' {A364FBDC-658A-454F-BEE4-96AB206F4B52} S-1-5-21-1960123792-2022915161-3775307078-1001:tmewpyjbeohl\user:Interactive:[1]
