Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = 'Update.dll'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'LoadAppInit_DLLs' = '00000001'
Modifies file system
Creates the following files
- <SYSTEM32>\libcurl.dll
- %WINDIR%\temp\tarcc37.tmp
- %WINDIR%\temp\cabcc36.tmp
- %WINDIR%\temp\tarcb7a.tmp
- %WINDIR%\temp\cabcb79.tmp
- %WINDIR%\temp\tarcb2a.tmp
- %WINDIR%\temp\cabcb29.tmp
- %WINDIR%\temp\tarca5d.tmp
- %WINDIR%\temp\cabca5c.tmp
- %WINDIR%\temp\tarca1d.tmp
- %WINDIR%\temp\cabca1c.tmp
- %WINDIR%\temp\cabcfa2.tmp
- %WINDIR%\temp\tarc921.tmp
- %WINDIR%\temp\tarc8f0.tmp
- %WINDIR%\temp\cabc8ef.tmp
- %WINDIR%\temp\tarc8bf.tmp
- %WINDIR%\temp\cabc8be.tmp
- %WINDIR%\temp\tarc86f.tmp
- %WINDIR%\temp\cabc86e.tmp
- %WINDIR%\temp\tarc774.tmp
- %WINDIR%\temp\cabc773.tmp
- <SYSTEM32>\update.dll
- <SYSTEM32>\zlib1.dll
- %WINDIR%\temp\cabc920.tmp
- %WINDIR%\temp\tarcfa3.tmp
Deletes the following files
- %WINDIR%\temp\cabc773.tmp
- %WINDIR%\temp\tarcc37.tmp
- %WINDIR%\temp\cabcc36.tmp
- %WINDIR%\temp\tarcb7a.tmp
- %WINDIR%\temp\cabcb79.tmp
- %WINDIR%\temp\tarcb2a.tmp
- %WINDIR%\temp\cabcb29.tmp
- %WINDIR%\temp\tarca5d.tmp
- %WINDIR%\temp\cabca5c.tmp
- %WINDIR%\temp\tarca1d.tmp
- %WINDIR%\temp\cabca1c.tmp
- %WINDIR%\temp\tarc921.tmp
- %WINDIR%\temp\cabc920.tmp
- %WINDIR%\temp\tarc8f0.tmp
- %WINDIR%\temp\cabc8ef.tmp
- %WINDIR%\temp\tarc8bf.tmp
- %WINDIR%\temp\cabc8be.tmp
- %WINDIR%\temp\tarc86f.tmp
- %WINDIR%\temp\cabc86e.tmp
- %WINDIR%\temp\tarc774.tmp
- %WINDIR%\temp\cabcfa2.tmp
- %WINDIR%\temp\tarcfa3.tmp
Network activity
Connects to
- '10#.#68.135.168':80
- 'localhost':49183
- 'localhost':49185
- 'ke##uth.win':443
- 'ke##uth.win':80
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://10#.#68.135.168/downloads/libcurl.dll
- http://10#.#68.135.168/downloads/zlib1.dll
- http://10#.#68.135.168/crab/Client.dll
- http://x1.#.lencr.org/
Other
- 'localhost':49183
- 'localhost':49185
- 'localhost':49186
- 'ke##uth.win':443
UDP
- DNS ASK ke##uth.win
- DNS ASK x1.#.lencr.org
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c certutil -hashfile "<Full path to file>" MD5 | find /i /v "md5" | find /i /v "certutil"
- '<SYSTEM32>\certutil.exe' -hashfile "<Full path to file>" MD5
- '<SYSTEM32>\find.exe' /i /v "md5"
- '<SYSTEM32>\find.exe' /i /v "certutil"
- '<SYSTEM32>\cmd.exe' /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
- '<SYSTEM32>\cmd.exe' /C "color b && title Error && echo SSL connect error && timeout /t 5"
- '<SYSTEM32>\timeout.exe' /t 5
