Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Fdhlajk' = 'C:\Users\Public\Libraries\kjalhdF.url'
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Creates and executes the following (exploit)
- 'C:\users\public\vbc.exe'
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- C:\users\public\vbc.exe
- C:\users\public\libraries\fdhlajk\fdhlajk.exe
- C:\users\public\libraries\kjalhdf.url
- C:\users\public\kdeco.bat
- C:\users\public\uko.bat
- C:\users\public\trast.bat
- C:\users\public\nest
- C:\users\public\nest.bat
Deletes the following files
- C:\users\public\kdeco.bat
- C:\users\public\uko.bat
- C:\users\public\trast.bat
- C:\users\public\nest.bat
Network activity
Connects to
- '19#.#2.91.161':80
- 'on####ve.live.com':443
- 'px####.#n.files.1drv.com':443
- 'mo###ssence.com':80
- 'la######cssolicitors.com':80
- 'oc##.thawte.com':80
- 'am####rowser.com':80
- 'al###nfarma.com':80
- 'fa##ase.fan':80
- 'mi#####eensdress.com':80
- 'ex####snailsspa.com':80
- 'e-###box.com':80
- 'tr###yheld.com':80
- 'mu####organics.com':80
- 'fu####rexian.com':80
TCP
HTTP GET requests
- http://www.th#####rotection.net/6mam/?kp#####################################################################################
- http://www.be###ninjas.com/6mam/?kp#####################################################################################
- http://www.sc#####rontoffice.com/6mam/?kp#####################################################################################
Other
- 'on####ve.live.com':443
- 'px####.#n.files.1drv.com':443
UDP
- DNS ASK on####ve.live.com
- DNS ASK sc#####rontoffice.com
- DNS ASK tr###yheld.com
- DNS ASK e-###box.com
- DNS ASK ex####snailsspa.com
- DNS ASK be###ninjas.com
- DNS ASK mi#####eensdress.com
- DNS ASK ap####ift.support
- DNS ASK fa##ase.fan
- DNS ASK al###nfarma.com
- DNS ASK th#####rotection.net
- DNS ASK am####rowser.com
- DNS ASK oc##.thawte.com
- DNS ASK la######cssolicitors.com
- DNS ASK mo###ssence.com
- DNS ASK px####.#n.files.1drv.com
- DNS ASK mu####organics.com
- DNS ASK fu####rexian.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\Users\Public\Trast.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\Users\Public\nest.bat" "' (with hidden window)
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\mobsync.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\Users\Public\Trast.bat" "
- '%WINDIR%\syswow64\cmd.exe' /K C:\Users\Public\UKO.bat
- '%WINDIR%\syswow64\reg.exe' delete hkcu\Environment /v windir /f
- '%WINDIR%\syswow64\reg.exe' add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\cmd.exe' del "%WINDIR%\SysWOW64\mobsync.exe"
- '%WINDIR%\syswow64\schtasks.exe' /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\Users\Public\nest.bat" "
