Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'DiscordUpdater' = '%LOCALAPPDATA%\DiscordUpdater.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'System' = '%LOCALAPPDATA%\System.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\discordsoftwareupdater.exe
- %APPDATA%\microsoft\windows\start menu\programs\startup\discordsoftwareupdaternew.exe
Malicious functions
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:49176;https=127.0.0.1:49176;socks=127.0.0.1:49175'
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '<local>'
Modifies file system
Creates the following files
- %TEMP%\discordupdater.exe
- %LOCALAPPDATA%\system.exe
- %TEMP%\check.txt
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\logo[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\discordupdater.exe
- %HOMEPATH%\documents\runcommand.bat
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\zygqy9h0\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\eusa5a0u\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\nn4qkv3o\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\4to0xzj2\desktop.ini
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %HOMEPATH%\documents\status0.txt
- %APPDATA%\psiphon3\psiphon.boltdb
- %HOMEPATH%\documents\roblox\robloxplayerlauncher.exe
- %TEMP%\dew.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\main[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\icomoon[1]
- %TEMP%\datad0b.tmp
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\logo-bw[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\psicash_coin[1]
- %TEMP%\psiphon3.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\psicash_coin_grey[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\flag_unknown_32[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\banner[1]
- %APPDATA%\psiphon3\psicash\psicashdatastore.prod.temp
- %APPDATA%\psiphon3\psiphon.config
- %APPDATA%\psiphon3\server_list.dat
- %TEMP%\psiphon-tunnel-core.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\flags32[1]
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %TEMP%\hold1.txt
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\zygqy9h0\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\eusa5a0u\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\nn4qkv3o\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\4to0xzj2\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
Deletes the following files
- %APPDATA%\psiphon3\psicash\psicashdatastore.prod
- %HOMEPATH%\documents\runcommand.bat
- %HOMEPATH%\documents\status0.txt
- %TEMP%\hold1.txt
Moves the following files
- from %APPDATA%\psiphon3\psicash\psicashdatastore.prod.temp to %APPDATA%\psiphon3\psicash\psicashdatastore.prod.commit
- from %APPDATA%\psiphon3\psicash\psicashdatastore.prod.commit to %APPDATA%\psiphon3\psicash\psicashdatastore.prod
Substitutes the following files
- %APPDATA%\psiphon3\psicash\psicashdatastore.prod.temp
- %APPDATA%\psiphon3\psicash\psicashdatastore.prod.commit
- %APPDATA%\psiphon3\psicash\psicashdatastore.prod
- %HOMEPATH%\documents\runcommand.bat
Network activity
TCP
HTTP GET requests
- http://x.##2.us/x.cer
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
HTTP POST requests
- http://www.ag######plateholdings.com/
UDP
- DNS ASK ra#.####ubusercontent.com
- DNS ASK a1###.w7.akamai.net
- DNS ASK a1###.na.akamai.net
- '31.#.152.207':53
Miscellaneous
Searches for the following windows
- ClassName: 'Internet Explorer_Server' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\discordupdater.exe'
- '%TEMP%\psiphon3.exe'
- '%TEMP%\psiphon-tunnel-core.exe' --config "%APPDATA%\Psiphon3\psiphon.config" --serverList "%APPDATA%\Psiphon3\server_list.dat"
- '%HOMEPATH%\documents\roblox\robloxplayerlauncher.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%HOMEPATH%\Documents\RunCommand.bat" "
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v DiscordUpdater /t REG_SZ /d "%LOCALAPPDATA%\DiscordUpdater.exe
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v System /t REG_SZ /d "%LOCALAPPDATA%\System.exe
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' https://ipfounder.net/?sponsor_id=1BC527D3D09985CF&sponsor=psiphon&client_region=NL&client_platform=windows&secret=580EfjEI29xL3hoyU6dgP4vSEVxdcGI7JDFkxgjds7PHulSEF0wmORpvzbqxyTwYtpowsY4xMFnfWE...
