Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\servicehub settings host{k8e7y2o3t4q-x9c3h1k9e7p1a8-p4s5i2q6q5w}
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
Modifies file system
Creates the following files
- %APPDATA%\microsoft\hosts\servicehub.exe
- %APPDATA%\microsoft\hosts\463265237217472347120
Deletes the following files
- %APPDATA%\microsoft\hosts\463265237217472347120
Substitutes the following files
- %APPDATA%\microsoft\hosts\463265237217472347120
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /create /F /sc minute /mo 5 /tn "ServiceHub Settings Host{K8E7Y2O3T4Q-X9C3H1K9E7P1A8-P4S5I2Q6Q5W}" /tr "%APPDATA%\Microsoft\Hosts\ServiceHub.exe"
- '%WINDIR%\syswow64\schtasks.exe' /Query /XML /TN "ServiceHub Settings Host{K8E7Y2O3T4Q-X9C3H1K9E7P1A8-P4S5I2Q6Q5W}"
