Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\msiexec
- <SYSTEM32>\tasks\smss
- <SYSTEM32>\tasks\idle
- <SYSTEM32>\tasks\explorer
- <SYSTEM32>\tasks\sppsvc
- <SYSTEM32>\tasks\firefox
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\among us.exe
- C:\totalcmd\language\0a1fd5f707cd16ea89afd3d6db52b2da58214a6c
- C:\totalcmd\language\sppsvc.exe
- %WINDIR%\migration\wtr\7a0fd90576e08807bde2cc57bcf9854bbce05fe3
- %WINDIR%\migration\wtr\explorer.exe
- %ProgramFiles(x86)%\winamp\microsoft.vc90.crt\6ccacd8608530fba3a93e87ae2225c7032aa18c1
- %ProgramFiles(x86)%\winamp\microsoft.vc90.crt\idle.exe
- %ALLUSERSPROFILE%\microsoft toolkit\firefox.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\69ddcba757bf72f7d36c464c71f42baab150b2b9
- <Current directory>\133006b48fb54b65ec2045921283a18304e24d5a
- <Current directory>\msiexec.exe
- nul
- C:\documents and settings\9db6e019d4f04ef534d0f91b3462d805c40e9d20
- C:\documents and settings\iexplore.exe
- %TEMP%\chrome.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\smss.exe
- %ALLUSERSPROFILE%\microsoft toolkit\0fc223bdacedc38dd6d2772d547ade1563558e92
Sets the 'hidden' attribute to the following files
- %TEMP%\among us.exe
- %TEMP%\chrome.exe
Network activity
Connects to
- '62.##9.31.33':80
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
Creates and executes the following
- '%TEMP%\among us.exe'
- '%TEMP%\chrome.exe'
- '%ALLUSERSPROFILE%\microsoft toolkit\firefox.exe'
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Documents and Settings\iexplore.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "msiexec" /sc ONLOGON /tr "'<Current directory>\msiexec.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\smss.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Winamp\Microsoft.VC90.CRT\Idle.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'%WINDIR%\Migration\WTR\explorer.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "sppsvc" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\sppsvc.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Microsoft Toolkit\firefox.exe'" /rl HIGHEST /f
