Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\myapp
- <SYSTEM32>\tasks\upmyapp
- <SYSTEM32>\tasks\my app
Modifies file system
Creates the following files
- %TEMP%\r_w.db
- %ProgramFiles%\text\text\vclimg150.bpl
- %ProgramFiles%\text\text\vcl150.bpl
- %ProgramFiles%\text\text\txt2pdf.exe
- %ProgramFiles%\text\text\s_dl.db
- %ProgramFiles%\text\text\rtl150.bpl
- %ProgramFiles%\text\text\ini.ini
- %ProgramFiles%\text\text\emcommon64.dll
- %ProgramFiles%\text\text\emcommon.bpl
- %TEMP%\text_ap.bak
- C:\baklog\appxml.xml
- C:\baklog\myapp.xml
- %TEMP%\text\xml.end
- %TEMP%\text\xml.head
- %ProgramFiles%\text\vclx150.bpl
- %ProgramFiles%\text\vclimg150.bpl
- %ProgramFiles%\text\vcl150.bpl
- %ProgramFiles%\text\txt2pdf.exe
- %ProgramFiles%\text\s_dl.db
- %ProgramFiles%\text\rtl150.bpl
- %ProgramFiles%\text\new.db
- %ProgramFiles%\text\emcommon64.dll
- %ProgramFiles%\text\emcommon.bpl
- %TEMP%\text.bak
- %ProgramFiles%\text\text\vclx150.bpl
- %TEMP%\text\and-key.reg
Deletes the following files
- %TEMP%\r_w.db
- %TEMP%\text.bak
- %TEMP%\text\xml.head
- %TEMP%\text\xml.end
- C:\baklog\myapp.xml
- %TEMP%\text_ap.bak
- C:\baklog\appxml.xml
Network activity
Connects to
- '3d######.###.cn-south-1.myhuaweicloud.com':80
- 'mu####.g3bsawkb.xyz':13799
TCP
HTTP GET requests
- http://3d######.###.cn-south-1.myhuaweicloud.com/driverfile/data/R_W.db
- http://3d######.###.cn-south-1.myhuaweicloud.com/driverfile/data/text.bak
- http://3d######.###.cn-south-1.myhuaweicloud.com/driverfile/data/Head.Bak
- http://3d######.###.cn-south-1.myhuaweicloud.com/driverfile/data/End.Bak
- http://3d######.###.cn-south-1.myhuaweicloud.com/driverfile/data/text_ap.bak
- http://3d######.###.cn-south-1.myhuaweicloud.com/driverfile/data/and-key.reg
UDP
- DNS ASK 3d######.###.cn-south-1.myhuaweicloud.com
- DNS ASK mu####.g3bsawkb.xyz
Miscellaneous
Modifies value of AutoConfigURL parameter to 'http://ielh8towbruajtxdqnuv.lqepn95z.xyz:36988/api/pac/pacReback.html?key=10397'
Searches for the following windows
- ClassName: 'ConsoleWindowClass' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%WINDIR%\regedit.exe' /S %TEMP%\text\and-key.reg' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /Create /tn MyApp /XML C:\BakLog\MyApp.xml /F
- '<SYSTEM32>\schtasks.exe' /Create /tn UpMyApp /XML C:\BakLog\AppXml.xml /F
- '<SYSTEM32>\schtasks.exe' /Create /TN "My App" /TR "'%WINDIR%\regedit.exe' /S %TEMP%\text\and-key.reg" /mo 01 /sc minute /IT /F
- '<SYSTEM32>\taskeng.exe' {D903DD8B-2C1D-473B-A6A4-4E6408954F3F} S-1-5-21-1960123792-2022915161-3775307078-1001:dhkolycigc\user:Interactive:[1]
- '%WINDIR%\regedit.exe' /S %TEMP%\text\and-key.reg
