Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\explorere
- <SYSTEM32>\tasks\explorer
- <SYSTEM32>\tasks\iexplorei
- <SYSTEM32>\tasks\iexplore
Creates the following files on removable media
- <Drive name for removable media>:\2d95b61f11c7cc72b31606bc22cb7cba.exe
- <Drive name for removable media>:\glidescope_review_rev_010.lnk
- <Drive name for removable media>:\issi2013_template_for_posters.lnk
- <Drive name for removable media>:\file_p_00000000_1371597592.lnk
- <Drive name for removable media>:\sdszfo.lnk
- <Drive name for removable media>:\applicantform_en.lnk
- <Drive name for removable media>:\fi51.lnk
- <Drive name for removable media>:\february_catalogue__2015.lnk
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.lnk
- <Drive name for removable media>:\hanni_umami_chapter.lnk
- <Drive name for removable media>:\weeklysheet1215.lnk
- <Drive name for removable media>:\lisp_success.lnk
- <Drive name for removable media>:\pmd.lnk
- <Drive name for removable media>:\utorrent.lnk
- <Drive name for removable media>:\sdksampleprivdeveloper.lnk
- <Drive name for removable media>:\contoso_1.lnk
- <Drive name for removable media>:\sdksampleunprivdeveloper.lnk
- <Drive name for removable media>:\sdkfailsafeemulator.lnk
- <Drive name for removable media>:\contosoroot_1.lnk
- <Drive name for removable media>:\dashborder_192.lnk
- <Drive name for removable media>:\dashborder_144.lnk
- <Drive name for removable media>:\dashborder_96.lnk
- <Drive name for removable media>:\tileimage.lnk
- <Drive name for removable media>:\000814251_video_01.lnk
- <Drive name for removable media>:\correct.lnk
- <Drive name for removable media>:\delete.lnk
- <Drive name for removable media>:\archer.lnk
- <Drive name for removable media>:\contoso.lnk
- <Drive name for removable media>:\calc.lnk
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
blocks the following features:
- User Account Control (UAC)
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\sessionmonitor.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\kms\iexplore.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Current directory>\explorer.exe'
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\update_script.bat
- %TEMP%\rarsfx0\readme.txt
- %TEMP%\rarsfx0\upd16fx.exe
- %TEMP%\rarsfx0\temp_commands.bat
- %TEMP%\rarsfx1\upd16.exe
- %ALLUSERSPROFILE%\vmjcf4hs2fatjcqqeduwlk.bat
- %ALLUSERSPROFILE%\sessionmonitor.exe
- %ALLUSERSPROFILE%\koasjla4e1h.vbe
- <Current directory>\explorer.exe
- <Current directory>\7a0fd90576e088
- C:\kms\iexplore.exe
- C:\kms\9db6e019d4f04e
- %TEMP%\kb5rgpa7xe
- %TEMP%\bn9glwll3z.bat
- nul
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\2d95b61f11c7cc72b31606bc22cb7cba.exe
Deletes the following files
- %TEMP%\rarsfx0\temp_commands.bat
- %TEMP%\rarsfx1\upd16.exe
- %TEMP%\rarsfx0\readme.txt
- %TEMP%\rarsfx0\upd16fx.exe
- %TEMP%\rarsfx0\update_script.bat
- %TEMP%\kb5rgpa7xe
Network activity
Connects to
- '68#####m.nyashkoon.top':80
TCP
HTTP GET requests
- http://68#####m.nyashkoon.top/ExternalProcessdefault.php?fG######################################################################################################################################...
- http://68#####m.nyashkoon.top/ExternalProcessdefault.php?uJ######################################################################################################################################...
UDP
- DNS ASK 68#####m.nyashkoon.top
- 'localhost':123
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\upd16fx.exe' -p3mkRsPeV8KfDYgbFtzYq
- '%TEMP%\rarsfx1\upd16.exe'
- '%WINDIR%\syswow64\wscript.exe' "%ALLUSERSPROFILE%\kOasJla4E1h.vbe"
- '%ALLUSERSPROFILE%\sessionmonitor.exe'
- 'C:\kms\iexplore.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\vMJCf4HS2FATjCqqEDUWlk.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\bn9GlWlL3z.bat"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\update_script.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\vMJCf4HS2FATjCqqEDUWlk.bat" "
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 12 /tr "'<Current directory>\explorer.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'<Current directory>\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 10 /tr "'<Current directory>\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 14 /tr "'C:\kms\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\kms\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 13 /tr "'C:\kms\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\bn9GlWlL3z.bat"
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
