Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'APXDCV_' = '%ProgramFiles(x86)%\Gur8lmtb\xbkdy8qjrsd5.exe'
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Creates and executes the following (exploit)
- '%APPDATA%\svchost.exe'
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
- %WINDIR%\syswow64\chkdsk.exe
the following user processes:
- iexplore.exe
- firefox.exe
Hooks functions
in browsers
- firefox.exe process, nss3.dll module
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\autoconv.exe
Modifies file system
Creates the following files
- %APPDATA%\svchost.exe
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %APPDATA%\o20qboue\o20logrv.ini
- %APPDATA%\o20qboue\o20logri.ini
- %TEMP%\fanebridewell.dll
- %TEMP%\carafe
- %TEMP%\img\prepare\vswebdesignedui.dll
- %TEMP%\img\prepare\webp.xml
- %TEMP%\img\prepare\aximp.exe
- %APPDATA%\o20qboue\o20logim.jpeg
- %TEMP%\img\prepare\rsobjectsui.dll
- %TEMP%\img\prepare\guidgen.exe
- %TEMP%\img\prepare\72.opends60.dll
- %TEMP%\img\prepare\x-matroska-3d.xml
- %TEMP%\img\prepare\rcxditui.dll
- %TEMP%\img\prepare\solarized-dark.xml
- %TEMP%\img\prepare\x-abiword.xml
- %TEMP%\img\prepare\microsoftvsdesignerui.dll
- %TEMP%\img\prepare\66.opends60.dll
- %TEMP%\img\prepare\38.opends60.dll
- %TEMP%\img\prepare\x-sega-pico-rom.xml
- %TEMP%\nsr1d36.tmp
- %TEMP%\img\prepare\x-sass.xml
- %APPDATA%\o20qboue\o20logrf.ini
Network activity
TCP
HTTP GET requests
- http://ru############nxmenischangedtonewperpvc.duckdns.org/russdoc/regasm.exe
- http://www.ga###027.com/0gb/?Kd####################################################################################
UDP
- DNS ASK ru############nxmenischangedtonewperpvc.duckdns.org
- DNS ASK sb##.ltd
- DNS ASK di####ntoffer.win
- DNS ASK lr#####eradunyasi.com
- DNS ASK ga###027.com
Miscellaneous
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\rundll32.exe' FaneBridewell,Vitta
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\chkdsk.exe'
- '%WINDIR%\syswow64\cmd.exe' del "%WINDIR%\SysWOW64\cmd.exe"
- '%ProgramFiles(x86)%\mozilla firefox\firefox.exe'
