Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\matthewchat
Modifies file system
Creates the following files
- %TEMP%\ray.ini
- %TEMP%\triple.ini
- %TEMP%\walk.ini
- %TEMP%\steal.ini
- %TEMP%\rings.ini
- %TEMP%\bears.ini
- %TEMP%\living.ini
- %TEMP%\fabulous.ini
- %TEMP%\traffic.ini
- %TEMP%\triple.ini.bat
- %TEMP%\trips
- %TEMP%\principle.ini
- %TEMP%\fwd.ini
- %TEMP%\gospel
- %TEMP%\programming
- %TEMP%\measurement
- %TEMP%\mongolia
- %TEMP%\compatibility
- %TEMP%\gb
- %TEMP%\actually
- %TEMP%\icq
- %TEMP%\445002\ce.com
- %TEMP%\445002\j
- %LOCALAPPDATA%\cybersphere dynamics\n
- %TEMP%\eleven
- %TEMP%\toshiba
- %TEMP%\cameroon.ini
- %TEMP%\relates.ini
- %TEMP%\gathered.ini
- %TEMP%\gently.ini
- %TEMP%\midnight.ini
- %TEMP%\commissioners.ini
- %TEMP%\certification.ini
- %TEMP%\assign.ini
- %TEMP%\mauritius.ini
- %TEMP%\utils.ini
- %TEMP%\hotmail.ini
- %TEMP%\camera.ini
- %TEMP%\ebony.ini
- %TEMP%\sunglasses.ini
- %TEMP%\tripadvisor.ini
- %TEMP%\premier.ini
- %TEMP%\pm.ini
- %TEMP%\policy.ini
- %TEMP%\indicating.ini
- %TEMP%\close.ini
- %TEMP%\coalition.ini
- %TEMP%\accommodations.ini
- %TEMP%\autos.ini
- %TEMP%\dom.ini
- %TEMP%\sixth.ini
- %TEMP%\das.ini
- %TEMP%\fought.ini
- %TEMP%\determine.ini
- %LOCALAPPDATA%\cybersphere dynamics\matthewchat.com
- %LOCALAPPDATA%\cybersphere dynamics\matthewchat.js
Deletes the following files
- %TEMP%\445002\j
Deletes itself.
Network activity
UDP
- DNS ASK Ej############FSgrmRDOGB.EjzprANPyqQFYxFSgrmRDOGB
Miscellaneous
Creates and executes the following
- '%TEMP%\445002\ce.com' J
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c copy Triple.ini Triple.ini.bat & Triple.ini.bat
- '%WINDIR%\syswow64\tasklist.exe'
- '%WINDIR%\syswow64\findstr.exe' /I "opssvc wrsa"
- '%WINDIR%\syswow64\findstr.exe' "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
- '%WINDIR%\syswow64\cmd.exe' /c md 445002
- '%WINDIR%\syswow64\extrac32.exe' /Y /E Determine.ini
- '%WINDIR%\syswow64\findstr.exe' /V "INTRODUCTORY" Programming
- '%WINDIR%\syswow64\cmd.exe' /c copy /b 445002\Ce.com + Toshiba + Gospel + Measurement + Mongolia + Icq + Gb + Actually + Eleven + Compatibility + Trips 445002\Ce.com
- '%WINDIR%\syswow64\cmd.exe' /c copy /b ..\Dom.ini + ..\Principle.ini + ..\Living.ini + ..\Ray.ini + ..\Gently.ini + ..\Relates.ini + ..\Coalition.ini + ..\Rings.ini + ..\Commissioners.ini + ..\Policy.ini + ..\Fought.ini +...
- '%WINDIR%\syswow64\choice.exe' /d y /t 15
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "MatthewChat" /tr "wscript //B '%LOCALAPPDATA%\CyberSphere Dynamics\MatthewChat.js'" /sc onlogon /F /RL HIGHEST
- '%WINDIR%\syswow64\cmd.exe' /c copy Triple.ini Triple.ini.bat & Triple.ini.bat' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "MatthewChat" /tr "wscript //B '%LOCALAPPDATA%\CyberSphere Dynamics\MatthewChat.js'" /sc onlogon /F /RL HIGHEST' (with hidden window)
