Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\buildsh.exe
Modifies file system
Creates the following files
- %TEMP%\buildsh.exe
- %TEMP%\costura.microsoft.bcl.asyncinterfaces.dll.compressed
- %TEMP%\costura.netstandard.dll.compressed
- %TEMP%\costura.newtonsoft.json.dll.compressed
- %TEMP%\costura.system.buffers.dll.compressed
- %TEMP%\costura.system.collections.immutable.dll.compressed
- %TEMP%\costura.system.drawing.common.dll.compressed
- %TEMP%\hh.exe
- %TEMP%\costura.system.interactive.async.dll.compressed
- %TEMP%\costura.system.memory.dll.compressed
- %TEMP%\costura.system.numerics.vectors.dll.compressed
- %TEMP%\costura.system.runtime.compilerservices.unsafe.dll.compressed
- %TEMP%\costura.system.threading.tasks.extensions.dll.compressed
- %TEMP%\costura.metadata
- %TEMP%\ss.png
- %TEMP%\costura.dotnetzip.pdb.compressed
- %TEMP%\costura.leaf.xnet.dll.compressed
- %TEMP%\costura.dotnetzip.dll.compressed
- %TEMP%\costura.discord.net.webhook.dll.compressed
- %TEMP%\costura.discord.net.rest.dll.compressed
- %TEMP%\config
- %TEMP%\whysosad
- %TEMP%\rtkbtmanserv.exe
- %TEMP%\bfsvc.cfg
- %TEMP%\xwizard.cfg
- %TEMP%\bfsvc.exe
- %TEMP%\compile.bat
- %TEMP%\costura.system.linq.async.dll.compressed
- %TEMP%\winhlp32.exe
- %TEMP%\xwizard.exe
- %TEMP%\snuvcdsm.exe
- %TEMP%\costura.costura.dll.compressed
- %TEMP%\costura.costura.pdb.compressed
- %TEMP%\costura.discord webhook.dll.compressed
- %TEMP%\costura.discord.net.core.dll.compressed
- %TEMP%\socket.exe
- %TEMP%\splwow64.exe
- %TEMP%\compile.vbs
Deletes the following files
- %TEMP%\ss.png
- %TEMP%\compile.bat
- %TEMP%\compile.vbs
Modifies the following files
Network activity
Connects to
- 'ap###.ipify.org':443
- 'microsoft.com':80
- 'di##ord.com':443
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Other
- 'ap###.ipify.org':443
- 'di##ord.com':443
UDP
- DNS ASK it####lvehacker.gq
- DNS ASK ap###.ipify.org
- DNS ASK microsoft.com
- DNS ASK di##ord.com
Miscellaneous
Creates and executes the following
- '%TEMP%\buildsh.exe'
- '%TEMP%\socket.exe'
- '%TEMP%\rtkbtmanserv.exe' ZhXl39BlhP84+Y4kurA8wpehxxqA0X22IMYZ6Vpiqs4pPmxkndxkBivMfZN5LAOMiY2BN3lKI+5pcMZ7b1ZRKYi1nn9FmS4SFSCwpQKFMqxuvG3yWlwhPFr3nAM4lfj2AlEbdJVGSRM8qAK+00u/xbu3i1pLhLpT07BaZrE6i7g=
- '<SYSTEM32>\wscript.exe' "%TEMP%\compile.vbs"
- '%TEMP%\snuvcdsm.exe' /stext "%TEMP%\user_Passwords.txt"
- '%TEMP%\winhlp32.exe' /stext "%TEMP%\Cookies1"
- '%TEMP%\splwow64.exe' /stext "%TEMP%\Cookies2"
- '%TEMP%\hh.exe' /stext "%TEMP%\Cookies3"
- '%TEMP%\xwizard.exe' /stext "%TEMP%\user_History.txt"
- '<SYSTEM32>\cmd.exe' /c compile.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c start "" "%TEMP%\buildsh.exe"
- '%WINDIR%\syswow64\cmd.exe' /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms;[System.Windows.Forms.MessageBox]::Show('ERROR : MISSING FILE','Error','OK','Error')"
- '%WINDIR%\syswow64\cmd.exe' /c start "" "%TEMP%\socket.exe"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-Type -AssemblyName System.Windows.Forms;[System.Windows.Forms.MessageBox]::Show('ERROR : MISSING FILE','Error','OK','Error')"
- '<SYSTEM32>\cmd.exe' /c compile.bat
- '<SYSTEM32>\wscript.exe' "%TEMP%\compile.vbs"
