Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\rundll32.exe' shell32.dll,ShellExec_RunDLL %TEMP%\fgkfhjkdfhkljslkjsgkljhnkljs.lnk
Modifies file system
Creates the following files
- %APPDATA%\microsoft\sgegkseg23mjl.dll
- %TEMP%\fgkfhjkdfhkljslkjsgkljhnkljs.lnk
Moves the following files
- from %APPDATA%\microsoft\sgegkseg23mjl.dll to %TEMP%\dfshim.dll
- from %TEMP%\dfshim.dll to %TEMP%\tmp5b68.tmp
Network activity
Connects to
- 'wo###ow.website':443
- 'pk#.goog':80
TCP
HTTP GET requests
- http://pk#.goog/gsr1/gsr1.crt
Other
- 'wo###ow.website':443
UDP
- DNS ASK wo###ow.website
- DNS ASK pk#.goog
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\rundll32.exe' shell32.dll,ShellExec_RunDLL %TEMP%\fgkfhjkdfhkljslkjsgkljhnkljs.lnk' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' /u /s "%APPDATA%\Microsoft\sgegkseg23mjl.dll"' (with hidden window)
- '%WINDIR%\syswow64\rundll32.exe' "%TEMP%\dfshim.dll",cleanonlineappcache' (with hidden window)
Executes the following
- '<SYSTEM32>\regsvr32.exe' /u /s "%APPDATA%\Microsoft\sgegkseg23mjl.dll"
- '%WINDIR%\syswow64\rundll32.exe' "%TEMP%\dfshim.dll",cleanonlineappcache
