Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\Webview Helper] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\Webview Helper] 'ImagePath' = 'C:\Users\Public\Videos\qdLDSHHc\4I1KZLMf.exe'
Creates the following services
- 'Webview Helper' C:\Users\Public\Videos\qdLDSHHc\4I1KZLMf.exe
Malicious functions
Patches code
in dll
- 4i1kzlmf.exe process, jcef_helper.exe module
in NTDLL dll
- app.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\fqfmao8ktzkueovr\readme.md
- %ALLUSERSPROFILE%\fqfmao8ktzkueovr\app.exe
- %ALLUSERSPROFILE%\fqfmao8ktzkueovr\app.exe._
- %ALLUSERSPROFILE%\fqfmao8ktzkueovr\web.dat
- %ALLUSERSPROFILE%\fqfmao8ktzkueovr\view.dat
- %ALLUSERSPROFILE%\fqfmao8ktzkueovr\view.conf
- C:\users\public\videos\pstyztof
- C:\users\public\videos\qdldshhc\readme.md
- C:\users\public\videos\qdldshhc\view.conf
- C:\users\public\videos\qdldshhc\409.exe
- C:\users\public\videos\qdldshhc\libcef.dll
Deletes following files that it created itself
- C:\users\public\videos\pstyztof
- %ALLUSERSPROFILE%\fqfmao8ktzkueovr\app.exe._
- %ALLUSERSPROFILE%\fqfmao8ktzkueovr\view.dat
- %ALLUSERSPROFILE%\fqfmao8ktzkueovr\web.dat
- %ALLUSERSPROFILE%\fqfmao8ktzkueovr\readme.md
- %ALLUSERSPROFILE%\fqfmao8ktzkueovr\view.conf
Moves the following files
- from C:\users\public\videos\qdldshhc\409.exe to C:\users\public\videos\qdldshhc\4i1kzlmf.exe
- from %ALLUSERSPROFILE%\fqfmao8ktzkueovr\app.exe to \:dsl
Network activity
Connects to
- '19#.#29.116.49':30003
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\fqfmao8ktzkueovr\app.exe'
- 'C:\users\public\videos\qdldshhc\4i1kzlmf.exe'
