Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\service\diagnostic
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %TEMP%\9335\_screen_desktop.jpeg
- %TEMP%\qozviab.tmp
- %TEMP%\autaf13.tmp
- %TEMP%\ila02164
- %TEMP%\9335.zip
- %TEMP%\9335\_firefox\key3.db
- %TEMP%\9335\_firefox\cookies.sqlite
- %TEMP%\9335\_firefox\formhistory.sqlite
- %APPDATA%\serviceget\$dpx$.tmp\f8128ea6efdb724d8ef93fbd7851bec4.tmp
- %TEMP%\9335\_opera\default_key.bin
- %TEMP%\9335\_opera\default_logins.db
- %TEMP%\9335\_opera\default_webdata.db
- %TEMP%\9335\_chrome\default_key.bin
- %TEMP%\9335\_chrome\default_cookies.db
- %TEMP%\9335\_chrome\default_logins.db
- %TEMP%\9335\_chrome\default_webdata.db
- %TEMP%\9335\_information.txt
- %TEMP%\9335\_opera\default_cookies.db
- %APPDATA%\serviceget\$dpx$.tmp\a73f331a6a6024448713ec301de1abf9.tmp
Deletes the following files
- %TEMP%\9335.zip~rf158d8f.tmp
- %TEMP%\9335.zip~rf158ddd.tmp
- %TEMP%\9335\_information.txt
- %TEMP%\9335\_screen_desktop.jpeg
- %TEMP%\9335\_chrome\default_cookies.db
- %TEMP%\9335\_chrome\default_key.bin
- %TEMP%\9335\_chrome\default_logins.db
- %TEMP%\9335\_chrome\default_webdata.db
- %TEMP%\9335\_firefox\cookies.sqlite
- %TEMP%\9335\_firefox\formhistory.sqlite
- %TEMP%\9335\_firefox\key3.db
- %TEMP%\9335\_opera\default_cookies.db
- %TEMP%\9335\_opera\default_key.bin
- %TEMP%\9335\_opera\default_logins.db
- %TEMP%\9335\_opera\default_webdata.db
- %TEMP%\autaf13.tmp
Moves the following files
- from %TEMP%\9335.zip to %TEMP%\9335.zip~rf158d8f.tmp
- from %TEMP%\9335.zip to %TEMP%\9335.zip~rf158ddd.tmp
- from %APPDATA%\serviceget\$dpx$.tmp\f8128ea6efdb724d8ef93fbd7851bec4.tmp to %APPDATA%\serviceget\pokumi.dat
- from %APPDATA%\serviceget\$dpx$.tmp\a73f331a6a6024448713ec301de1abf9.tmp to %APPDATA%\serviceget\pokumi.exe
Substitutes the following files
- %TEMP%\9335.zip
- %TEMP%\ila02164
Network activity
UDP
- DNS ASK sa###b62.top
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%APPDATA%\serviceget\pokumi.exe' "%APPDATA%\ServiceGet\Pokumi.dat"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%HOMEPATH%\Desktop\*.txt" "%TEMP%\9335\_Files"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c expand.exe "%TEMP%\qoZviab.tmp" -F:* "%APPDATA%\ServiceGet" & schtasks /create /tn \Service\Diagnostic /tr """"%APPDATA%\ServiceGet\Pokumi.exe""" """%APPDATA%\ServiceGet\Pokumi.dat"""" /st 0...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\key4.db" "%TEMP%\9335\_Firefox\key4.db"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\key3.db" "%TEMP%\9335\_Firefox\key3.db"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\logins.json" "%TEMP%\9335\_Firefox\logins.json"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\signons.sqlite" "%TEMP%\9335\_Firefox\signons.sqlite"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\cookies.sqlite" "%TEMP%\9335\_Firefox\cookies.sqlite"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\formhistory.sqlite" "%TEMP%\9335\_Firefox\formhistory.sqlite"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Opera Software\Opera Stable\Network\Cookies" "%TEMP%\9335\_Opera\default_cookies.db"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Opera Software\Opera Stable\Login Data" "%TEMP%\9335\_Opera\default_logins.db"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Opera Software\Opera Stable\Web Data" "%TEMP%\9335\_Opera\default_webdata.db"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%LOCALAPPDATA%\google\chrome\User Data\Default\Network\Cookies" "%TEMP%\9335\_Chrome\default_cookies.db"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%LOCALAPPDATA%\google\chrome\User Data\Default\Cookies" "%TEMP%\9335\_Chrome\default_cookies.db"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%LOCALAPPDATA%\google\chrome\User Data\Default\Login Data" "%TEMP%\9335\_Chrome\default_logins.db"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%LOCALAPPDATA%\google\chrome\User Data\Default\Web Data" "%TEMP%\9335\_Chrome\default_webdata.db"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Opera Software\Opera Stable\Cookies" "%TEMP%\9335\_Opera\default_cookies.db"' (with hidden window)
- '%APPDATA%\serviceget\pokumi.exe' "%APPDATA%\ServiceGet\Pokumi.dat"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%HOMEPATH%\Desktop\*.txt" "%TEMP%\9335\_Files"
- '%WINDIR%\syswow64\expand.exe' "%TEMP%\qoZviab.tmp" -F:* "%APPDATA%\ServiceGet"
- '%WINDIR%\syswow64\cmd.exe' /c expand.exe "%TEMP%\qoZviab.tmp" -F:* "%APPDATA%\ServiceGet" & schtasks /create /tn \Service\Diagnostic /tr """"%APPDATA%\ServiceGet\Pokumi.exe""" """%APPDATA%\ServiceGet\Pokumi.dat"""" /st 0...
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\key4.db" "%TEMP%\9335\_Firefox\key4.db"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\key3.db" "%TEMP%\9335\_Firefox\key3.db"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\logins.json" "%TEMP%\9335\_Firefox\logins.json"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\signons.sqlite" "%TEMP%\9335\_Firefox\signons.sqlite"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\cookies.sqlite" "%TEMP%\9335\_Firefox\cookies.sqlite"
- '%WINDIR%\syswow64\schtasks.exe' /create /tn \Service\Diagnostic /tr """"%APPDATA%\ServiceGet\Pokumi.exe""" """%APPDATA%\ServiceGet\Pokumi.dat"""" /st 00:01 /du 9800:39 /sc once /ri 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\formhistory.sqlite" "%TEMP%\9335\_Firefox\formhistory.sqlite"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Opera Software\Opera Stable\Cookies" "%TEMP%\9335\_Opera\default_cookies.db"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Opera Software\Opera Stable\Login Data" "%TEMP%\9335\_Opera\default_logins.db"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Opera Software\Opera Stable\Web Data" "%TEMP%\9335\_Opera\default_webdata.db"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%LOCALAPPDATA%\google\chrome\User Data\Default\Network\Cookies" "%TEMP%\9335\_Chrome\default_cookies.db"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%LOCALAPPDATA%\google\chrome\User Data\Default\Cookies" "%TEMP%\9335\_Chrome\default_cookies.db"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%LOCALAPPDATA%\google\chrome\User Data\Default\Login Data" "%TEMP%\9335\_Chrome\default_logins.db"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%LOCALAPPDATA%\google\chrome\User Data\Default\Web Data" "%TEMP%\9335\_Chrome\default_webdata.db"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Opera Software\Opera Stable\Network\Cookies" "%TEMP%\9335\_Opera\default_cookies.db"
- '<SYSTEM32>\taskeng.exe' {4DCA3335-1974-4843-BF91-BB052F529640} S-1-5-21-1960123792-2022915161-3775307078-1001:nxfpulq\user:Interactive:[1]
