Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\kms\Idle.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Current directory>\WUDFHost.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles(x86)%\Windows Photo Viewer\en-US\explorer.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\kms\WUDFHost.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles%\Java\jre1.8.0_45\lib\cmm\firefox.exe'
Modifies file system
Creates the following files
- C:\kms\idle.exe
- %TEMP%\zklyuy2uqz
- %HOMEPATH%\desktop\adnxqihm.log
- %HOMEPATH%\desktop\cnjyqamn.log
- %HOMEPATH%\desktop\tpodjdcb.log
- %HOMEPATH%\desktop\yhdwnegy.log
- %TEMP%\zvvxkkmds4.bat
- %TEMP%\qe7ibevenm
- %HOMEPATH%\desktop\amqvrfuc.log
- %HOMEPATH%\desktop\jqzlbzjj.log
- %HOMEPATH%\desktop\tedblker.log
- %HOMEPATH%\desktop\txqmilkk.log
- nul
- %TEMP%\wphqxn8u4y.bat
- %TEMP%\nolg89nx17
- %ProgramFiles%\java\jre1.8.0_45\lib\cmm\0fc223bdacedc3
- %ProgramFiles%\java\jre1.8.0_45\lib\cmm\firefox.exe
- C:\kms\480b7989c529f6
- C:\kms\wudfhost.exe
- %ProgramFiles(x86)%\windows photo viewer\en-us\7a0fd90576e088
- %ProgramFiles(x86)%\windows photo viewer\en-us\explorer.exe
- <Current directory>\480b7989c529f6
- <Current directory>\wudfhost.exe
- C:\kms\6ccacd8608530f
- %TEMP%\bx5frbeeju.bat
- %HOMEPATH%\desktop\cygmcoge.log
Deletes the following files
- %TEMP%\nolg89nx17
- %TEMP%\qe7ibevenm
- %TEMP%\zklyuy2uqz
Network activity
Connects to
- 'we#####.craft-host.ru':80
UDP
- DNS ASK we#####.craft-host.ru
- 'localhost':123
Miscellaneous
Creates and executes the following
- 'C:\kms\wudfhost.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\wPHQXn8u4y.bat"
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\ping.exe' -n 10 localhost
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\zvVxKkmDS4.bat"
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\bx5FrBeEju.bat"
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\4tBkEffHSx.bat"
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\wPHQXn8u4y.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\zvVxKkmDS4.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\bx5FrBeEju.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\4tBkEffHSx.bat"' (with hidden window)
