Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im chrome.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im firefox.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im thunderbird.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im explorer.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\8989.tmp\darkspider 1.5.bat
- <Current directory>\adadfgdfgdfgdfh
- <Current directory>\sdfsdfsdssf.bat
- <Current directory>\sdfsdfsttttts.bat
- <Current directory>\dfdfgdsttfgdfg.reg
- <Current directory>\dfsgdestrg.trz
- <Current directory>\dfgddsfygd.txt
- <Current directory>\gfhffgthfg.java
- <Current directory>\ojfdgrg
- <Current directory>\dfgdefghdfg
- <Current directory>\gfhfghfg.xss
- <Current directory>\jhgfd
- <Current directory>\tjufhfxn
- <Current directory>\fgdfeg
- <Current directory>\iohjfhgfh
- <Current directory>\hyksdkodsopsdf
- <Current directory>\idfdfgdfgdfg
- <Current directory>\jpjghjpghjg
- <Current directory>\dfjijijio
- <Current directory>\ioptyio.c
- <Current directory>\export
- <Current directory>\whxss.soverride
- <Current directory>\trasck.trj
- <Current directory>\ioptyio.rar
- <Current directory>\dfjijisjio.exe
- <Current directory>\jpjghjpsghjg
- <Current directory>\extraitab
- <Current directory>\2t2tab
- <Current directory>\whx.override
- <Current directory>\track.trj
- <Current directory>\ada.tmp
- <Current directory>\sdfsdfsdf
- <Current directory>\sdfsdfs
- <Current directory>\dfdfgdfgdfg.jpg
- <Current directory>\dfgderg
- <Current directory>\obj
- <Current directory>\hjfdfgsldf
- <Current directory>\dfgdfgd
- <Current directory>\dfgdftgdfg.bmp
- <Current directory>\qwder
- <Current directory>\jhgfdd
- <Current directory>\hjfdfgsfdf
- <Current directory>\tjufhffn
- <Current directory>\fgdfgf
- <Current directory>\iohjfhgffh
- <Current directory>\hyksdkodsopsdf.exe
- <Current directory>\idfdfgdssfgdfg.exe
- nul
- <Current directory>\ojfdg.java
- <Current directory>\aesloader
Network activity
Connects to
- 'localhost':49175
UDP
- DNS ASK clients2.google.com
- DNS ASK clients4.google.com
- DNS ASK google.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Google\Chrome\User Data'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\8989.tmp\DarkSpider 1.5.bat""
- '%WINDIR%\syswow64\net.exe' localgroup administrators javaxvk2s /add
- '%WINDIR%\syswow64\net1.exe' user javaxvk2s /add
- '%WINDIR%\syswow64\net.exe' user javaxvk2s /add
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="*BackgroundRendererProcesses/Disallow/*BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/Captive...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="BackgroundRendererProcesses/Disallow/*BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/CaptiveP...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="BackgroundRendererProcesses/Disallow/BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/CaptivePo...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=gpu-process --channel="2508.0.924930956\1759740658" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-device-id=0x0000 --gpu-driver-vendor --gp...
- '%ProgramFiles(x86)%\mozilla firefox\firefox.exe'
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe'
- '%WINDIR%\syswow64\ping.exe' localhost /n 4
- '%WINDIR%\syswow64\tasklist.exe'
- '%WINDIR%\syswow64\ping.exe' localhost /n 3
- '%WINDIR%\syswow64\ping.exe' localhost /n 2
- '%WINDIR%\syswow64\ping.exe' localhost /n 1
- '%WINDIR%\syswow64\ping.exe' localhost /n 5
- '%WINDIR%\syswow64\net1.exe' localgroup administrators javaxvk2s /add
- '%WINDIR%\syswow64\netstat.exe' /n
