Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im KsDumperClient.exe
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq fiddler*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq processhacker*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq cheatengine*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /f /im Dbg32.exe
- '<SYSTEM32>\taskkill.exe' /f /im Dbg64.exe
- '<SYSTEM32>\taskkill.exe' /f /im Ida64.exe
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /f /im x32dbg.exe
- '<SYSTEM32>\taskkill.exe' /f /im x64dbg.exe
- '<SYSTEM32>\taskkill.exe' /f /im OllyDbg.exe
- '<SYSTEM32>\taskkill.exe' /f /im HTTP Debugger Windows Service (32 bit).exe
- '<SYSTEM32>\taskkill.exe' /f /im cheatengine-i386.exe
- '<SYSTEM32>\taskkill.exe' /f /im MugenJinFuu-i386.exe
- '<SYSTEM32>\taskkill.exe' /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq wireshark*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /f /im cheatengine-x86_64-SSE4-AVX2.exe
- '<SYSTEM32>\taskkill.exe' /f /im Cheat Engine.exe
- '<SYSTEM32>\taskkill.exe' /f /im de4dot.exe
- '<SYSTEM32>\taskkill.exe' /f /im Xenos32.exe
- '<SYSTEM32>\taskkill.exe' /f /im Xenos.exe
- '<SYSTEM32>\taskkill.exe' /f /im Xenos64.exe
- '<SYSTEM32>\taskkill.exe' /f /im FiddlerEverywhere.exe
- '<SYSTEM32>\taskkill.exe' /f /im Fiddler.exe
- '<SYSTEM32>\taskkill.exe' /f /im Wireshark.exe
- '<SYSTEM32>\taskkill.exe' /f /im idaq64.exe
- '<SYSTEM32>\taskkill.exe' /f /im idaq.exe
- '<SYSTEM32>\taskkill.exe' /f /im ProcessHacker.exe
- '<SYSTEM32>\taskkill.exe' /f /im HTTPDebuggerSvc.exe
- '<SYSTEM32>\taskkill.exe' /f /im HTTPDebuggerUI.exe
- '<SYSTEM32>\taskkill.exe' /f /im KsDumper.exe
- '<SYSTEM32>\taskkill.exe' /f /im cheatengine-x86_64.exe
- '<SYSTEM32>\taskkill.exe' /IM HTTPDebuggerSvc.exe /F
Launches a large number of processes
Modifies file system
Creates the following files
- nul
- %ALLUSERSPROFILE%\hash.txt
Deletes the following files
- %ALLUSERSPROFILE%\hash.txt
Network activity
Connects to
- 'localhost':49179
- 'localhost':49181
- 'ke##uth.win':443
TCP
Other
- 'localhost':49179
- 'localhost':49181
- 'localhost':49182
- 'ke##uth.win':443
UDP
- DNS ASK ke##uth.win
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im KsDumperClient.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im Ida64.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im Dbg64.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im Dbg32.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c sc stop HTTPDebuggerPro >nul 2>&1
- '<SYSTEM32>\sc.exe' stop HTTPDebuggerPro
- '<SYSTEM32>\cmd.exe' /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\<INETFILES>\IE" >nul 2>&1
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1968.5.1540413455\2068271636" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '<SYSTEM32>\cmd.exe' /c certutil -hashfile <Full path to file> MD5 >> %ALLUSERSPROFILE%\hash.txt
- '<SYSTEM32>\certutil.exe' -hashfile <Full path to file> MD5
- '%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://cdn.discordapp.com/attachments/953053319415349249/959183313547968572/QuickSpoof.exe"
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://cdn.discordapp.com/attachments/953053319415349249/959183313547968572/QuickSpoof.exe
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://cdn.discordapp.com/attachments/953053319415349249/959183313547968572/QuickSpoof.exe /crash-reporter-parent-id=1968
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="1968.0.826862338\1595460632" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1968.4.1458743022\66597289" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im x32dbg.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im Xenos64.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im KsDumper.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im ProcessHacker.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im idaq.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im idaq64.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im Wireshark.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im Fiddler.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im FiddlerEverywhere.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im Xenos.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im OllyDbg.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im Xenos32.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im de4dot.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im Cheat Engine.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im MugenJinFuu-i386.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im cheatengine-i386.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im HTTP Debugger Windows Service (32 bit).exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im x64dbg.exe >nul 2>&1
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="1968.4.1458743022\66597289" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=1688
