Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\mui\l
- <SYSTEM32>\tasks\microsoft\windows\mui\multishare
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\CloudPrinter] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\CloudPrinter] 'ImagePath' = '%PROGRAMDATA%\\CloudPrinter\\CloudPrinter.exe shuz -f "%PROGRAMDATA%\\CloudPrinter\\CloudPrinter.dat" -l -a'
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
- firefox.exe
Modifies file system
Creates the following files
- %APPDATA%\microsoft\launcher.exe
- <LS_APPDATA>\config.xml
- <LS_APPDATA>\agent.dat
- <LS_APPDATA>\alphahome.tst
- <LS_APPDATA>\alphahome.exe
- %WINDIR%\syswow64\config\systemprofile\appdata\local\installer.dat
- %WINDIR%\syswow64\config\systemprofile\appdata\local\installationconfiguration.xml
- %PROGRAMDATA%\cloudprinter\config.xml
- %PROGRAMDATA%\cloudprinter\cloudprinter.dat
- %PROGRAMDATA%\cloudprinter\cloudprinter.exe
- <LS_APPDATA>\md.xml
- <LS_APPDATA>\lobby.dat
- <LS_APPDATA>\applicationhosting.dat
- <LS_APPDATA>\quotela.tst
- <LS_APPDATA>\quotela.exe
- <LS_APPDATA>\installer.dat
- <LS_APPDATA>\installationconfiguration.xml
- %TEMP%\fish.exe
- %APPDATA%\microsoft\multishare.exe
- %TEMP%\92de.tmp.exe
- <LS_APPDATA>\main.dat
- <LS_APPDATA>\noah.dat
Network activity
Connects to
- 'oc##.#tartssl.com':80
TCP
HTTP GET requests
- http://ho##as8.cf/click.php?cn#####################
- http://ip##pi.com/xml
- http://os##oft.com/20190118/things.xml
- http://www.os##oft.com/20190118/multishare.exe
- http://os##oft.com/bb/tds.php
- http://in#####.portmdfmoon.com/download/APSFADexpNR
- http://cd#.###3t2z8.hwcdn.net/whale.exe
- http://ma####.utyuytjn.com/MaxMind.asmx/GetGeoInfo
- http://up#####.utyuytjn.com/Update/CheckInstallConfig?de##########################################################################################################################
- http://cd#.###8s6m2.hwcdn.net/installer/installers-config/safefinder-ap/apsfadexpnr/ic240419.xml
- http://ap#.##zymount.com/v1/check
- http://cd#.###8s6m2.hwcdn.net/auto/ah.tst
- http://cl######arch.linkury.com/MaxMind.asmx/GetGeoInfo
- http://cd#.###8s6m2.hwcdn.net/auto/moses.tst
- http://sv#####ts.linkury.com/StateStatisticsService.svc/V1/JSON/GetDistributorIdFromNameHttpGet?di#########################
HTTP POST requests
- http://go#####analytics.com/collect
- http://sv#####ts.linkury.com/StatisticsService.svc/V1/JSON/LogEvent
UDP
- DNS ASK ho##as8.cf
- DNS ASK sv#####ts.salodo.com
- DNS ASK cl######arch.linkury.com
- DNS ASK ap#.##zymount.com
- DNS ASK cd#.###8s6m2.hwcdn.net
- DNS ASK st###.utyuytjn.com
- DNS ASK up#####.utyuytjn.com
- DNS ASK ma####.utyuytjn.com
- DNS ASK sv#####ts.linkury.com
- DNS ASK ca###xmylife.ml
- DNS ASK cd#.###3t2z8.hwcdn.net
- DNS ASK in#####.portmdfmoon.com
- DNS ASK li#####.##-us-west-2.amazonaws.com
- DNS ASK os##oft.com
- DNS ASK go#####analytics.com
- DNS ASK ip##pi.com
- DNS ASK go#########ate.blob.core.windows.net
- DNS ASK oc##.#tartssl.com
Miscellaneous
Searches for the following windows
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\92de.tmp.exe' 1
- '%TEMP%\fish.exe' {"packer":{"DistributerName":"APSFADexpNR","ChannelId":"3"},"Agent":{"SetAll":"true","campaignId":"212"}}
- '<LS_APPDATA>\quotela.exe' shuz -f "lobby.dat" -l -a DeviceId=77c6c507-7000-2f94-44fc-fe6964db2ecb Distributer=APSFADexpNR ChannelId=3 BarcodeId=54369003 ApName=Mbappert
- '%PROGRAMDATA%\cloudprinter\cloudprinter.exe' shuz -f "%PROGRAMDATA%\\CloudPrinter\\CloudPrinter.dat" -l -a
- '<LS_APPDATA>\alphahome.exe' shuz -f "noah.dat" -l -a DeviceId=77c6c507-7000-2f94-44fc-fe6964db2ecb Distributer=APSFADexpNR ChannelId=3 BarcodeId=54369003 DefaultSearchDomain=https://feed.sonic-search.com HomePageDomain=ht...
Executes the following
- '%WINDIR%\syswow64\sc.exe' create CloudPrinter binpath= "%PROGRAMDATA%\\CloudPrinter\\CloudPrinter.exe shuz -f \"%PROGRAMDATA%\\CloudPrinter\\CloudPrinter.dat\" -l -a" DisplayName= CloudPrinter start= auto
- '%WINDIR%\syswow64\sc.exe' create Mbappert binpath= "%PROGRAMDATA%\\Mbappert\\Mbappert.exe shuz -f \"%PROGRAMDATA%\\Mbappert\\Mbappert.dat\" -l -a" DisplayName= Mbappert start= auto
