Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\MsRkNrL] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\MsRkNrL] 'ImagePath' = '<SYSTEM32>\wscript.exe //B "C:\autoexec.vbs"'
Creates the following services
- 'MsRkNrL' <SYSTEM32>\wscript.exe //B "C:\autoexec.vbs"
- 'MsRkNrLwsf' <SYSTEM32>\wscript.exe //B "C:\autoexec.wsf"
Malicious functions
Creates and executes the following (exploit)
- '<SYSTEM32>\wscript.exe' //B "%TEMP%\rknrl.vbs"
Modifies file system
Creates the following files
- %TEMP%\dm6331.tmp
- %TEMP%\rad6e726.tmp
- %TEMP%\~cmdscript.tmp
- %TEMP%\raddd1a6.tmp
- %TEMP%\radc33b6.tmp
- %TEMP%\rade2125.tmp
- %TEMP%\radcaee6.tmp
- %TEMP%\rad0f18a.tmp
- %TEMP%\winstart.wsf
- %TEMP%\win.wsf
- %TEMP%\tmp.tmp
- %TEMP%\rad0b21c.tmp
- %TEMP%\radf958d.tmp
- %TEMP%\rad6be7c.tmp
- %TEMP%\rad069cf.tmp
- %TEMP%\rad041cc.tmp
- %TEMP%\winstart.vbs
- %TEMP%\rknrl.vbs
- C:\autoexec.wsf
- C:\tmp.tmp
Sets the 'hidden' attribute to the following files
- C:\autoexec.wsf
- C:\tmp.tmp
Deletes the following files
- %TEMP%\dm6332.tmp
- %TEMP%\dm7332.tmp
- %TEMP%\~cmdscript.tmp
Moves the following files
- from %TEMP%\rad041cc.tmp to %TEMP%\dm6332.tmp
- from %TEMP%\rad0f18a.tmp to %TEMP%\dm7332.tmp
Substitutes the following files
- %TEMP%\dm6332.tmp
- %TEMP%\dm7332.tmp
Network activity
Connects to
- 'ap#.##herscan.io':80
- 'a1.##s6.club':80
- 'a1.####botheworld.com':80
TCP
HTTP GET requests
- http://ap#.##herscan.io/api?mo#############################################################################
- http://a1.##s6.club/ctrl/url.html
- http://a1.####botheworld.com/ctrl/url.html
- http://a1.##s6.club/ctrl/playback.php
- http://a1.####botheworld.com/ctrl/playback.php
- http://a1.####botheworld.com/ctrl/file/TMP.TMP
- http://a1.####botheworld.com/ctrl/file/winstart.wsf
- http://10#.#73.153.173/ctrl/playback.php
- http://10#.#73.153.173/ctrl/pool.txt
- http://10#.#73.153.173/ctrl/Normal.doc
- http://10#.#73.153.173/ctrl/Book.xls
UDP
- DNS ASK ap#.##herscan.io
- DNS ASK ai########ill.aigoingtokill.club
- DNS ASK a1.##s6.club
- DNS ASK a1.####botheworld.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' //B "%TEMP%\winstart.vbs"
- '<SYSTEM32>\wscript.exe' //B "%TEMP%\win.wsf"
- '<SYSTEM32>\wscript.exe' //B "%TEMP%\winstart.wsf"
- '<SYSTEM32>\wscript.exe' //B "%TEMP%\rknrl.vbs"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c nslookup a1.airobotheworld.com>>%TEMP%\~cmdscript.tmp' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c nslookup a1.airobotheworld.com>>%TEMP%\~cmdscript.tmp
- '<SYSTEM32>\nslookup.exe' a1.airobotheworld.com
