Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\svchost
- <SYSTEM32>\tasks\lsm
- <SYSTEM32>\tasks\taskhost
- <SYSTEM32>\tasks\audiodg
- <SYSTEM32>\tasks\cmd
Creates the following files on removable media
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\svchost.exe
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Modifies file system
Creates the following files
- C:\intosaves\degk490afxe5zd8pdvlb.exe
- <Current directory>\b75386f1303e64d8139363b71e44ac16341adf4e
- <Current directory>\taskhost.exe
- C:\totalcmd\language\ebf1f9fa8afd6d1932bd65bc4cc3af89a4c8e228
- C:\totalcmd\language\cmd.exe
- %ProgramFiles%\digsby-app\f4d236fdec2fd03914189c3b26e5cb0dfea9d761
- %ProgramFiles%\digsby-app\svchost.exe
- %ProgramFiles%\teatimer\42af1c969fbb7b2ae36b0e06bea61fc9a154b4af
- %ProgramFiles%\teatimer\audiodg.exe
- %ALLUSERSPROFILE%\adobe\arm\s\10428\b75386f1303e64d8139363b71e44ac16341adf4e
- C:\far2\encyclopedia\tap\svchost.exe
- %ALLUSERSPROFILE%\adobe\arm\s\10428\taskhost.exe
- C:\totalcmd\language\lsm.exe
- %TEMP%\28a4c5a141f877704cc74985a745162a.dat
- %ALLUSERSPROFILE%\oracle\java\installcache_x64\f4d236fdec2fd03914189c3b26e5cb0dfea9d761
- %ALLUSERSPROFILE%\oracle\java\installcache_x64\svchost.exe
- C:\intosaves\gqws4bm9sjlvow5zmhf4366oabqwna.vbe
- C:\intosaves\brokersvc.exe
- C:\intosaves\btmxvm06qi0qi5eb3nqi7an45pqekn.bat
- C:\intosaves\ilpxtdctr4avrcfylgugb4e8o7vtlv.bat
- C:\intosaves\jkpq5vdlcfizkjfdj4xxanmscsb5ki.vbe
- C:\totalcmd\language\101b941d020240259ca4912829b53995ad543df6
- C:\far2\encyclopedia\tap\f4d236fdec2fd03914189c3b26e5cb0dfea9d761
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\autorun.inf
- <Drive name for removable media>:\svchost.exe
Network activity
TCP
HTTP GET requests
- http://la####nk.beget.tech/pgofzftnelhu53gj7qbwil2vo/wdudq3g2kgqynzkz3no/2567a69ad4530fca36b400b2fcb8e7046cf66b64.php?03###############################################################
- http://la####nk.beget.tech/pgofzftnelhu53gj7qbwil2vo/wdudq3g2kgqynzkz3no/2567a69ad4530fca36b400b2fcb8e7046cf66b64.php?38#########################################################################...
- http://la####nk.beget.tech/pgofzftnelhu53gj7qbwil2vo/wdudq3g2kgqynzkz3no/l816cvr06ketdyfofybzgrp3y02e08n72hkl5r4isjzn9qt75w18a4m8vsbletrcuo54dbkjmo4qoik7/28cbdff50840061f442066069d33b1f5.php?f2...
UDP
- DNS ASK la####nk.beget.tech
- DNS ASK ip##fo.io
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "C:\intosaves\jkpQ5VdLcFIZkJfdj4XXANmsCsB5KI.vbe"
- 'C:\intosaves\degk490afxe5zd8pdvlb.exe' -pded1ec9ccd78d329e49f3466ea49a9e2da020d3f
- '%WINDIR%\syswow64\wscript.exe' "C:\intosaves\gqWS4bM9Sjlvow5Zmhf4366oABqWnA.vbe"
- 'C:\intosaves\brokersvc.exe'
- 'C:\far2\encyclopedia\tap\svchost.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\intosaves\ilpxTDctr4AVrcFYlgUgB4e8o7VTlV.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\intosaves\btmxvm06Qi0qI5eB3nQI7AN45pQekN.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\intosaves\ilpxTDctr4AVrcFYlgUgB4e8o7VTlV.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\intosaves\btmxvm06Qi0qI5eB3nQI7AN45pQekN.bat" "
- '<SYSTEM32>\schtasks.exe' /create /tn "svchost" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Oracle\Java\installcache_x64\svchost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Adobe\ARM\S\10428\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'%ProgramFiles%\TeaTimer\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "svchost" /sc ONLOGON /tr "'%ProgramFiles%\digsby-app\svchost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "cmd" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\cmd.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'<Current directory>\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "svchost" /sc ONLOGON /tr "'C:\Far2\Encyclopedia\tap\svchost.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-MpPreference -verbose
