Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent c80f6cad83272458
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /pId 2532
Modifies file system
Creates the following files
- %APPDATA%\iditeug
- %TEMP%\8b3b.exe
- %APPDATA%\thunderbird\profiles\wjj9aet2.default\cookies.sqlite-shm
Sets the 'hidden' attribute to the following files
- %APPDATA%\iditeug
Deletes the following files
- %TEMP%\8b3b.exe
- %APPDATA%\thunderbird\profiles\wjj9aet2.default\cookies.sqlite-shm
Modifies the following files
Deletes itself.
Network activity
Connects to
- 'ho####ile-host6.com':80
- '19#.#33.8.122':80
- 'tr##sfer.sh':443
- 'gi##ub.com':443
- 'dl.###oadgram.me':443
- 'cd#####.anonfiles.com':443
- 'ip###ger.org':443
TCP
HTTP POST requests
- http://ho####ile-host6.com/
Other
- 'tr##sfer.sh':443
- 'gi##ub.com':443
- 'dl.###oadgram.me':443
- 'cd#####.anonfiles.com':443
- 'ip###ger.org':443
UDP
- DNS ASK ho####ile-host6.com
- DNS ASK tr##sfer.sh
- DNS ASK gi##ub.com
- DNS ASK dl.###oadgram.me
- DNS ASK microsoft.com
- DNS ASK cd#####.anonfiles.com
- DNS ASK ip###ger.org
Miscellaneous
Creates and executes the following
- '%TEMP%\8b3b.exe'
- '<SYSTEM32>\cmd.exe' /c dEL /f /Q /a r S h A i *.* & eRase %teMp% /f /s /Q & Cd \ & PiNg -n 2 127.0.0.1 & powershell -Command "Get-Process | Where-Object {$_.Path -like \"*$env:TEMP*\"} | kill" & rd /s /q "%temP%\M...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C cD \ & tasKKill /f /pId 2532 & piNg -n 1 127.0.0.1 & deL /f /q /a r S h A i "%TEMP%\D085.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c cHOice /C y /n /D Y /T 1 & DEl /f /Q /a r s h a i "%TEMP%\MS_a$$hole_1MS_\Win32WebViewHost.exe"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c dEL /f /Q /a r S h A i *.* & eRase %teMp% /f /s /Q & Cd \ & PiNg -n 2 127.0.0.1 & powershell -Command "Get-Process | Where-Object {$_.Path -like \"*$env:TEMP*\"} | kill" & rd /s /q "%temP%\M...
- '<SYSTEM32>\cmd.exe' /C cD \ & tasKKill /f /pId 2532 & piNg -n 1 127.0.0.1 & deL /f /q /a r S h A i "%TEMP%\D085.exe"
- '<SYSTEM32>\cmd.exe' /c cHOice /C y /n /D Y /T 1 & DEl /f /Q /a r s h a i "%TEMP%\MS_a$$hole_1MS_\Win32WebViewHost.exe"
- '<SYSTEM32>\cmd.exe' /C choice /C Y /N /D Y /T 0 &Del %TEMP%\8B3B.exe
- '<SYSTEM32>\choice.exe' /C Y /N /D Y /T 0
- '<SYSTEM32>\choice.exe' /C y /n /D Y /T 1
- '<SYSTEM32>\ping.exe' -n 1 127.0.0.1
- '<SYSTEM32>\ping.exe' -n 2 127.0.0.1
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-Process | Where-Object {$_.Path -like \"*$env:TEMP*\"} | kill"
