Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MarketAdvior' = '"%APPDATA%\MarketAdvior\python\pythonw.exe" "load.pyc" ml2'
Creates or modifies the following files
- <SYSTEM32>\tasks\marketadvior
- <SYSTEM32>\tasks\marketadvior2
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Modifies file system
Creates the following files
- %TEMP%\marketadvior.exe
- %APPDATA%\marketadvior\python\python37._pth
- %APPDATA%\marketadvior\python\python37.dll
- %APPDATA%\marketadvior\python\python37.zip
- %APPDATA%\marketadvior\python\pythonw.exe
- %APPDATA%\marketadvior\python\select.pyd
- %APPDATA%\marketadvior\python\sqlite3.dll
- %APPDATA%\marketadvior\python\unicodedata.pyd
- %APPDATA%\marketadvior\python\vcruntime140.dll
- %APPDATA%\marketadvior\python\winsound.pyd
- %APPDATA%\marketadvior\pi.txt
- %TEMP%\multishare.exe
- %APPDATA%\marketadvior\subid.txt
- %APPDATA%\marketadvior\pbid.txt
- %APPDATA%\marketadvior\pburl.txt
- %APPDATA%\marketadvior\pb2url.txt
- %APPDATA%\marketadvior\uuid.txt
- %TEMP%\_fidx1du
- %TEMP%\tmp7vmnmo6d
- %APPDATA%\marketadvior\pbsent.txt
- %APPDATA%\marketadvior\uninstall.exe
- %APPDATA%\marketadvior\python\python3.dll
- %TEMP%\nsr93a9.tmp\nsexec.dll
- %APPDATA%\marketadvior\python\python.exe
- %APPDATA%\marketadvior\python\_elementtree.pyd
- %TEMP%\nsx8a70.tmp
- %APPDATA%\marketadvior\load.bin
- %APPDATA%\marketadvior\load.pyc
- %APPDATA%\marketadvior\mcfckchjhehcdgoeihjjjbkcdpdfmloa.crx
- %APPDATA%\marketadvior\python\license.txt
- %APPDATA%\marketadvior\python\_asyncio.pyd
- %APPDATA%\marketadvior\python\_bz2.pyd
- %APPDATA%\marketadvior\python\_ctypes.pyd
- %APPDATA%\marketadvior\python\_decimal.pyd
- %APPDATA%\marketadvior\python\_hashlib.pyd
- %APPDATA%\marketadvior\python\libssl-1_1.dll
- %APPDATA%\marketadvior\python\_lzma.pyd
- %APPDATA%\marketadvior\python\_msi.pyd
- %APPDATA%\marketadvior\python\_multiprocessing.pyd
- %APPDATA%\marketadvior\python\_overlapped.pyd
- %APPDATA%\marketadvior\python\_queue.pyd
- %APPDATA%\marketadvior\python\_socket.pyd
- %APPDATA%\marketadvior\python\_sqlite3.pyd
- %APPDATA%\marketadvior\python\_ssl.pyd
- %APPDATA%\marketadvior\python\libcrypto-1_1.dll
- %APPDATA%\marketadvior\python\pyexpat.pyd
- %TEMP%\tmpkt_ziydg
Deletes the following files
- %TEMP%\_fidx1du
- %TEMP%\nsr93a9.tmp\nsexec.dll
- %TEMP%\tmp7vmnmo6d
- %TEMP%\tmpkt_ziydg
Network activity
TCP
HTTP GET requests
- http://ho##as5.ml/click.php?cn#######################
- http://ya###etn1k.ru/files/MarketAdvior.exe
- http://www.go#####analytics.com/collect?v=#######################################################################################################################################################...
- http://os##oft.com/20190118/multishare.exe
- http://ho##as5.ml/click.php?cn#######################################
- http://os##oft.com/bb/tds.php
- http://ho##as5.ml/click.php?ke######################
UDP
- DNS ASK ho##as5.ml
- DNS ASK ya###etn1k.ru
- DNS ASK jj###.adsbtrk.com
- DNS ASK go#####analytics.com
- DNS ASK os##oft.com
- DNS ASK md##k.pro
Miscellaneous
Searches for the following windows
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\marketadvior.exe' /S /pb=https://jjmyn.adsbtrk.com/c/f9706f7de562eb2b?SUBID={SUBID}&PUBID={PUBID}&HID={HID}&GEO={GEO}&TS={TS} /pb2=https://jjmyn.adsbtrk.com/c/63ac61070427831d?SUBID={SUBID}&PUBID={PUBID}&HID={HI...
- '%APPDATA%\marketadvior\python\python.exe' load.pyc "akgdkknilkblpjcgpjmbjgpamneokmag;djgdgdcfmdkficbifbnaacknblbkhhoc;fdjdjkkjoiomafnihnobkinnfjnnlhdg;mocgkongaoagjoicmbimkiopebgfkich" checkinstalled
- '%APPDATA%\marketadvior\python\python.exe' load.pyc --subid="{SES}" --pbid="Pao" --pb="https://jjmyn.adsbtrk.com/c/f9706f7de562eb2b?SUBID={SUBID}&PUBID={PUBID}&HID={HID}&GEO={GEO}&TS={TS}" --pb2="https://jjmyn.adsbtrk.com/c/63ac61070427...
- '%APPDATA%\marketadvior\python\python.exe' load.pyc --act=inst ml2
- '%APPDATA%\marketadvior\python\python.exe' load.pyc launchall2
- '%APPDATA%\marketadvior\python\python.exe' load.pyc manage2
- '%APPDATA%\marketadvior\python\python.exe' load.py app
- '%TEMP%\multishare.exe'
- '%APPDATA%\marketadvior\python\python.exe' load.pyc "akgdkknilkblpjcgpjmbjgpamneokmag;djgdgdcfmdkficbifbnaacknblbkhhoc;fdjdjkkjoiomafnihnobkinnfjnnlhdg;mocgkongaoagjoicmbimkiopebgfkich" checkinstalled' (with hidden window)
- '%APPDATA%\marketadvior\python\python.exe' load.pyc --subid="{SES}" --pbid="Pao" --pb="https://jjmyn.adsbtrk.com/c/f9706f7de562eb2b?SUBID={SUBID}&PUBID={PUBID}&HID={HID}&GEO={GEO}&TS={TS}" --pb2="https://jjmyn.adsbtrk.com/c/63ac61070427...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /f /tn "MarketAdvior" /xml "%TEMP%\tmp7vmnmo6d"
- '%WINDIR%\syswow64\schtasks.exe' /create /f /tn "MarketAdvior" /xml "%TEMP%\tmp7vmnmo6d"
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /f /tn "MarketAdvior2" /xml "%TEMP%\tmpkt_ziydg"
- '%WINDIR%\syswow64\schtasks.exe' /create /f /tn "MarketAdvior2" /xml "%TEMP%\tmpkt_ziydg"
