Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\software\microsoft\windows\currentversion\run] 'XGYcMggA.exe' = '%HOMEPATH%\oqoIAsQs\XGYcMggA.exe'
- [<HKLM>\software\Wow6432Node\microsoft\windows\currentversion\run] 'aocMgwkk.exe' = '%ALLUSERSPROFILE%\LGQEMsYM\aocMgwkk.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\LGQEMsYM\aocMgwkk.exe,'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = 'userinit.exe,%ALLUSERSPROFILE%\LGQEMsYM\aocMgwkk.exe,'
Modifies file system
Creates the following files
- %HOMEPATH%\oqoiasqs\xgycmgga
- %ALLUSERSPROFILE%\lgqemsym\aocmgwkk
- %HOMEPATH%\oqoiasqs\xgycmgga.exe
- %ALLUSERSPROFILE%\lgqemsym\aocmgwkk.exe
- %WINDIR%\syswow64\config\systemprofile\oqoiasqs\xgycmgga
Network activity
TCP
- 'bl##k.io':443
UDP
- DNS ASK bl##k.io
Miscellaneous
Creates and executes the following
- '%HOMEPATH%\oqoiasqs\xgycmgga.exe'
- '%ALLUSERSPROFILE%\lgqemsym\aocmgwkk.exe'
