Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im pe.exe
- '<SYSTEM32>\taskkill.exe' /f /im Cheat Engine.exe
- '<SYSTEM32>\taskkill.exe' /f /im cheatengine-x86_64.exe
- '<SYSTEM32>\taskkill.exe' /f /im cheatengine-x86_64-SSE4-AVX2.exe
- '<SYSTEM32>\taskkill.exe' /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe
- '<SYSTEM32>\taskkill.exe' /f /im MugenJinFuu-i386.exe
- '<SYSTEM32>\taskkill.exe' /f /im cheatengine-i386.exe
- '<SYSTEM32>\taskkill.exe' /f /im OllyDbg.exe
- '<SYSTEM32>\taskkill.exe' /f /im ProcessHacker.exe
- '<SYSTEM32>\taskkill.exe' /f /im x64dbg.exe
- '<SYSTEM32>\taskkill.exe' /f /im x32dbg.exe
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /f /im Ida64.exe
- '<SYSTEM32>\taskkill.exe' /f /im Dbg64.exe
- '<SYSTEM32>\taskkill.exe' /f /im Dbg32.exe
- '<SYSTEM32>\taskkill.exe' /f /im de4dot.exe
- '<SYSTEM32>\taskkill.exe' /f /im Xenos32.exe
- '<SYSTEM32>\taskkill.exe' /f /im Xenos.exe
- '<SYSTEM32>\taskkill.exe' /f /im Xenos64.exe
- '<SYSTEM32>\taskkill.exe' /f /im FiddlerEverywhere.exe
- '<SYSTEM32>\taskkill.exe' /f /im Fiddler.exe
- '<SYSTEM32>\taskkill.exe' /f /im Wireshark.exe
- '<SYSTEM32>\taskkill.exe' /f /im idaq64.exe
- '<SYSTEM32>\taskkill.exe' /f /im idaq.exe
- '<SYSTEM32>\taskkill.exe' /f /im HTTP Debugger Windows Service (32 bit).exe
- '<SYSTEM32>\taskkill.exe' /f /im HTTPDebuggerSvc.exe
- '<SYSTEM32>\taskkill.exe' /f /im HTTPDebuggerUI.exe
- '<SYSTEM32>\taskkill.exe' /f /im KsDumper.exe
- '<SYSTEM32>\taskkill.exe' /f /im KsDumperClient.exe
- '<SYSTEM32>\taskkill.exe' /f /im Scylla.exe
- '<SYSTEM32>\taskkill.exe' /f /im Scylla_x64.exe
- '<SYSTEM32>\taskkill.exe' /f /im Scylla_x32.exe
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq cheatengine*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq processhacker*" /IM * /F /T
Searches for windows to
detect analytical utilities:
- ClassName: '', WindowName: 'The Wireshark Network Analyzer'
Modifies file system
Creates the following files
- nul
Network activity
Connects to
- 'localhost':49175
- 'localhost':49177
- 'ke##uth.win':443
TCP
Other
- 'localhost':49175
- 'localhost':49177
- 'localhost':49178
- 'ke##uth.win':443
UDP
- DNS ASK ke##uth.win
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'cheatengine-x86_64-SSE4-AVX2.exe'
- ClassName: '' WindowName: 'ida64'
- ClassName: '' WindowName: 'HTTP Debugger'
- ClassName: '' WindowName: 'HTTP Debugger (32bits)'
- ClassName: '' WindowName: 'Fiddler.WebUi'
- ClassName: '' WindowName: 'Dumpcap'
- ClassName: '' WindowName: 'Wireshark'
- ClassName: '' WindowName: 'Fiddler Everywhere'
- ClassName: '' WindowName: 'IDA v7.0.170914'
- ClassName: '' WindowName: 'idaq64'
- ClassName: '' WindowName: 'KsDumper'
- ClassName: '' WindowName: 'x64dbg'
- ClassName: '' WindowName: 'Progress Telerik Fiddler Web Debugger'
- ClassName: '' WindowName: 'MugenJinFuu-x86_64.exe'
- ClassName: '' WindowName: 'MugenJinFuu-x86_64-SSE4-AVX2.exe'
- ClassName: '' WindowName: 'Mugen JinFuu.exe'
- ClassName: '' WindowName: 'MugenJinFuu-i386.exe'
- ClassName: '' WindowName: 'dnSpy'
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im pe.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im de4dot.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im Cheat Engine.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im MugenJinFuu-i386.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im cheatengine-i386.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im HTTP Debugger Windows Service (32 bit).exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im OllyDbg.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im x64dbg.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im x32dbg.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im Ida64.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im Dbg64.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im Dbg32.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im Xenos32.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im Xenos.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im FiddlerEverywhere.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c del /f %WINDIR%\Globalization\Sorting\SortWindows63.nls
- '<SYSTEM32>\cmd.exe' /c cls
- '<SYSTEM32>\cmd.exe' /c Rename %WINDIR%\Globalization\Sorting\SortWindows63.nls %random%%random%
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im Scylla_x32.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im Scylla_x64.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im Scylla.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im KsDumperClient.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im KsDumper.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im ProcessHacker.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im idaq.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im idaq64.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im Wireshark.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im Fiddler.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im Xenos64.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
