Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%ALLUSERSPROFILE%\Oracle\Java\installcache_x64\smss.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'lsass' = '"<SYSTEM32>\KBDTH3\lsass.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'lsass' = '"<SYSTEM32>\KBDTH3\lsass.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'lsass' = '"C:\totalcmd\LANGUAGE\lsass.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'lsass' = '"C:\totalcmd\LANGUAGE\lsass.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'winlogon' = '"<SYSTEM32>\C_ISCII\winlogon.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'winlogon' = '"<SYSTEM32>\C_ISCII\winlogon.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'services' = '"<SYSTEM32>\certreq\services.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'services' = '"<SYSTEM32>\certreq\services.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'wininit' = '"%ALLUSERSPROFILE%\Favorites\wininit.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'WUDFHost' = '"%ProgramFiles%\ISSVC\WUDFHost.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"%ProgramFiles(x86)%\Internet Explorer\ie8props\iexplore.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'iexplore' = '"%ProgramFiles(x86)%\Internet Explorer\ie8props\iexplore.exe"'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%ALLUSERSPROFILE%\Oracle\Java\installcache_x64\smss.exe", "%ProgramFiles%\viritexp\conhost.exe", "%Progr...
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'conhost' = '"%ProgramFiles%\viritexp\conhost.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'conhost' = '"%ProgramFiles%\viritexp\conhost.exe"'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%ALLUSERSPROFILE%\Oracle\Java\installcache_x64\smss.exe", "%ProgramFiles%\viritexp\conhost.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'smss' = '"%ALLUSERSPROFILE%\Oracle\Java\installcache_x64\smss.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'smss' = '"%ALLUSERSPROFILE%\Oracle\Java\installcache_x64\smss.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WUDFHost' = '"%ProgramFiles%\ISSVC\WUDFHost.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'wininit' = '"%ALLUSERSPROFILE%\Favorites\wininit.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\smss
- <SYSTEM32>\tasks\conhost
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\wudfhost
- <SYSTEM32>\tasks\services
- <SYSTEM32>\tasks\winlogon
- <SYSTEM32>\tasks\lsass
- <SYSTEM32>\tasks\wininit
Modifies file system
Creates the following files
- C:\fontwindll\cybqsogk6ebp2.bat
- <SYSTEM32>\kbdth3\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9
- <SYSTEM32>\kbdth3\lsass.exe
- C:\totalcmd\language\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9
- C:\totalcmd\language\lsass.exe
- <SYSTEM32>\c_iscii\cc11b995f2a76da408ea6a601e682e64743153ad
- <SYSTEM32>\c_iscii\winlogon.exe
- <SYSTEM32>\certreq\c5b4cb5e9653cce737f29f72ba880dd4c4bab27d
- <SYSTEM32>\certreq\services.exe
- %ALLUSERSPROFILE%\favorites\wininit.exe
- %ProgramFiles%\issvc\480b7989c529f6ff17bde430d81d4770fb5337f5
- %ProgramFiles(x86)%\internet explorer\ie8props\9db6e019d4f04ef534d0f91b3462d805c40e9d20
- %ProgramFiles(x86)%\internet explorer\ie8props\iexplore.exe
- %ProgramFiles%\viritexp\088424020bedd6b28ac7fd22ee35dcd7322895ce
- %ProgramFiles%\viritexp\conhost.exe
- %ALLUSERSPROFILE%\oracle\java\installcache_x64\69ddcba757bf72f7d36c464c71f42baab150b2b9
- %ALLUSERSPROFILE%\oracle\java\installcache_x64\smss.exe
- C:\fontwindll\vxexkghjdv.vbe
- C:\fontwindll\fontwindlldlldhcpsvc.exe
- %ProgramFiles%\issvc\wudfhost.exe
- %ALLUSERSPROFILE%\favorites\560854153607923c4c5f107085a7db67be01f252
Network activity
Connects to
- 'cq####2.tmweb.ru':80
- 'vh###.timeweb.ru':443
TCP
HTTP GET requests
- http://cq####2.tmweb.ru/VideoFlower.php?t3#######################################################################################################################################################...
UDP
- DNS ASK cq####2.tmweb.ru
- DNS ASK vh###.timeweb.ru
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "C:\FontwinDll\vXExKGhjDV.vbe"
- 'C:\fontwindll\fontwindlldlldhcpsvc.exe'
- '%ALLUSERSPROFILE%\favorites\wininit.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\FontwinDll\cYBqsOGk6EBp2.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\FontwinDll\cYBqsOGk6EBp2.bat" "
- '<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Oracle\Java\installcache_x64\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost" /sc ONLOGON /tr "'%ProgramFiles%\viritexp\conhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Internet Explorer\ie8props\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'%ProgramFiles%\ISSVC\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'<SYSTEM32>\certreq\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'<SYSTEM32>\C_ISCII\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'<SYSTEM32>\KBDTH3\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Favorites\wininit.exe'" /rl HIGHEST /f
