Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\onedrive\onedriveupdatetask
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\taskmanager\config.txt
- %HOMEPATH%\download_libra.jar
- %LOCALAPPDATA%\microsoft\windows\explorer\cache.jar
- nul
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\83aa4cc77f591dfc2374580bbd95f6ba_d99ef00b-ccd3-4f1d-9980-90ac453b0b47
Deletes the following files
- %HOMEPATH%\download_libra.jar
Network activity
TCP
HTTP GET requests
- http://45.#.73.82/download/latest.jar
Other
- 'localhost':49185
- 'localhost':49210
- 'localhost':49204
- 'localhost':49209
- 'localhost':49207
- 'localhost':49205
- 'localhost':49203
- 'localhost':49195
- 'localhost':49199
- 'localhost':49197
- 'localhost':49201
- 'localhost':49208
- 'localhost':49200
- 'localhost':49196
- 'localhost':49194
- 'localhost':49186
- 'localhost':49192
- 'localhost':49188
- 'localhost':49190
- '45.#.73.82':12345
- 'localhost':49191
- 'localhost':49189
- 'localhost':49187
- 'localhost':49198
- 'localhost':49206
Miscellaneous
Executes the following
- '%ProgramFiles%\java\jre1.8.0_45\bin\javaw.exe' -jar "<Full path to file>"
- '%ProgramFiles%\java\jre1.8.0_45\bin\java.exe' -jar %HOMEPATH%\download_libra.jar
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%ProgramFiles%\java\jre1.8.0_45\...
- '<SYSTEM32>\cmd.exe'
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\config\system"
- '<SYSTEM32>\cmd.exe' /c SCHTASKS /CREATE /SC MINUTE /TN OneDrive\OneDriveUpdateTask /RL HIGHEST /TR %LOCALAPPDATA%\Microsoft\Windows\Explorer\cache.jar
- '<SYSTEM32>\schtasks.exe' /CREATE /SC MINUTE /TN OneDrive\OneDriveUpdateTask /RL HIGHEST /TR %LOCALAPPDATA%\Microsoft\Windows\Explorer\cache.jar
- '%ProgramFiles%\java\jre1.8.0_45\bin\javaw.exe' -jar "%LOCALAPPDATA%\Microsoft\Windows\Explorer\cache.jar"
- '<SYSTEM32>\cmd.exe' /c wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
- '<SYSTEM32>\wbem\wmic.exe' /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
- '<SYSTEM32>\cmd.exe' /c wmic cpu get name
- '<SYSTEM32>\wbem\wmic.exe' cpu get name
- '<SYSTEM32>\taskeng.exe' {FF2C6261-0CEF-43E3-8AD6-3A6CBB001A5E} S-1-5-21-3150914307-1777937420-491476919-1000:yotzvbgltfkt\user:Interactive:[1]
- '%ProgramFiles%\java\jre1.8.0_45\bin\javaw.exe' "%LOCALAPPDATA%\Microsoft\Windows\Explorer\cache.jar"
- '%ProgramFiles%\java\jre1.8.0_45\bin\javaw.exe' "%LOCALAPPDATA%\Microsoft\Windows\Explorer\cache.jar"' (with hidden window)
