Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im svhosts.exe
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\20155.cmd
- %TEMP%\7zipsfx.000\sedf81kq4
- %TEMP%\7zipsfx.000\sedetsxxb
- %TEMP%\7zipsfx.000\sedoi1wyn
- %TEMP%\7zipsfx.000\sedsnnewy
- %TEMP%\7zipsfx.000\exmacro.txt
- %TEMP%\7zipsfx.000\sedghbd09
- %TEMP%\7zipsfx.000\sedvkpvqi
- %TEMP%\7zipsfx.000\sed5m2sjm
- %TEMP%\7zipsfx.000\sedfyvgzq
- %TEMP%\7zipsfx.000\sedve5fs5
- %TEMP%\7zipsfx.000\sed7l0llk
- %TEMP%\7zipsfx.000\sedk6ovnp
- %TEMP%\7zipsfx.000\sedabmmfc
- %TEMP%\7zipsfx.000\sedwntzls
- %TEMP%\7zipsfx.000\sedql4lv5
- %TEMP%\7zipsfx.000\sedf0z8ee
- %TEMP%\7zipsfx.000\sedx9fsto
- %TEMP%\7zipsfx.000\sedt5ukjw
- %TEMP%\7zipsfx.000\sedpralcy
- %TEMP%\7zipsfx.000\mac.txt
- %TEMP%\7zipsfx.000\23910
- %TEMP%\7zipsfx.000\macrokey.txt
- %TEMP%\7zipsfx.000\sed.exe
- %TEMP%\7zipsfx.000\regex2.dll
- %TEMP%\7zipsfx.000\libintl3.dll
- %TEMP%\7zipsfx.000\libiconv2.dll
- %TEMP%\7zipsfx.000\1694
- %TEMP%\7zipsfx.000\exl.txt
- %TEMP%\7zipsfx.000\sedwetm9f
- %TEMP%\7zipsfx.000\dom
- %TEMP%\7zipsfx.000\somemacro.txt
- %TEMP%\7zipsfx.000\sed9xrgkh
- %TEMP%\7zipsfx.000\sediqorji
- %TEMP%\7zipsfx.000\sedijyjey
- %TEMP%\7zipsfx.000\sedegr8jp
- %TEMP%\7zipsfx.000\sedcelme4
- %TEMP%\7zipsfx.000\sed5cfhej
- %TEMP%\7zipsfx.000\sedxmzk1e
Moves the following files
- from %TEMP%\7zipsfx.000\23910 to %TEMP%\7zipsfx.000\23910.exe
- from %TEMP%\7zipsfx.000\1694 to %TEMP%\7zipsfx.000\svhosts.exe
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\7zipsfx.000\23910.exe' -ppfljk,fkbcerbgblfhs
- '%TEMP%\7zipsfx.000\sed.exe' -i s#TEXT05#KQTF# SomeMacro.txt
- '%TEMP%\7zipsfx.000\sed.exe' -i s#TEXT02#stereo-bit.site# SomeMacro.txt
- '%TEMP%\7zipsfx.000\sed.exe' -i s#TEXT03#ExelCreate_v.00A149B7# SomeMacro.txt
- '%TEMP%\7zipsfx.000\sed.exe' -i s#TEXT04#00A149B7# SomeMacro.txt
- '%TEMP%\7zipsfx.000\sed.exe' -i s#TEXT05#RKBX# ExMacro.txt
- '%TEMP%\7zipsfx.000\sed.exe' -i s#TEXT02#mototo.fun# ExMacro.txt
- '%TEMP%\7zipsfx.000\sed.exe' -i s#TEXT03#ExelCreate_v.00A149B7# ExMacro.txt
- '%TEMP%\7zipsfx.000\sed.exe' -i s#TEXT04#00A149B7# ExMacro.txt
- '%TEMP%\7zipsfx.000\svhosts.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.000\20155.cmd" "' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.000\20155.cmd" "
- '<SYSTEM32>\ipconfig.exe' /flushdns
- '<SYSTEM32>\cmd.exe' /c dir /b %WINDIR%\Microsoft.NET\Framework\v4*
- '<SYSTEM32>\cmd.exe' /c vol c
- '<SYSTEM32>\cmd.exe' /c echo %vKTQYKq:~10,1%
- '<SYSTEM32>\cmd.exe' /c echo %vKTQYKq:~16,1%
- '<SYSTEM32>\cmd.exe' /c echo %vKTQYKq:~45,1%
- '<SYSTEM32>\cmd.exe' /c echo %vKTQYKq:~57,1%
- '<SYSTEM32>\cmd.exe' /c echo %vKTQYKq:~43,1%
- '<SYSTEM32>\cmd.exe' /c echo %vKTQYKq:~62,1%
- '<SYSTEM32>\cmd.exe' /c echo %vKTQYKq:~1,1%
- '<SYSTEM32>\cmd.exe' /c echo %vKTQYKq:~23,1%
- '<SYSTEM32>\ping.exe' -n 5 8.8.8.8
