Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq fiddler*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq wireshark*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /IM HTTPDebuggerSvc.exe /F
Modifies file system
Creates the following files
- nul
- %TEMP%\etilqs_meaojsmapmjam4y
- %TEMP%\etilqs_r44hgwxezcl02po
- %TEMP%\etilqs_8u7txq0oyzizyl3
- %TEMP%\etilqs_nrtkegmlxqjji7w
- %TEMP%\etilqs_lrgjynzfwjbhvba
Network activity
Connects to
- 'localhost':49188
- 'localhost':49190
- 'ke##uth.win':443
TCP
Other
- '34.##9.100.209':443
- 'localhost':49188
- 'localhost':49190
- 'localhost':49191
- 'ke##uth.win':443
UDP
- DNS ASK ke##uth.win
- DNS ASK google.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'
Executes the following
- '<SYSTEM32>\cmd.exe' /c color 06
- '<SYSTEM32>\cmd.exe' /c cls
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="864.9.1012505315\1554175843" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="864.8.1831698789\125988653" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="864.7.1262177124\88998538" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="864.6.227301872\777465519" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="864.5.2062451512\1851655750" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="864.4.1052685425\1157919671" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="864.11.2014533398\1992458740" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="864.0.966370137\461100675" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-d...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://discord.gg/9XNHVzRGdN
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="864.10.944400271\2061051062" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://discord.gg/9XNHVzRGdN /crash-reporter-parent-id=864
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="864.4.1052685425\1157919671" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=984
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="864.15.1212126939\1549624155" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '<SYSTEM32>\sc.exe' stop HTTPDebuggerPro
- '<SYSTEM32>\cmd.exe' /c certutil -hashfile "<Full path to file>" MD5
- '<SYSTEM32>\cmd.exe' /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
- '%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://discord.gg/9XNHVzRGdN"
- '<SYSTEM32>\cmd.exe' /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\<INETFILES>\IE" >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c sc stop HTTPDebuggerPro >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\certutil.exe' -hashfile "<Full path to file>" MD5
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="864.12.759364906\1407157201" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '<SYSTEM32>\cmd.exe' /c start https://discord.gg/9XNHVzRGdN
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop HTTPDebuggerPro >nul 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\<INETFILES>\IE" >nul 2>&1' (with hidden window)
