Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\LqnIZf] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\LqnIZf] 'ImagePath' = 'cmd /c cd /d "C:\inetpub\wwwroot\GH39\1krTM8\lvW6\BYes\2dfSc\17rgPZ\Twulea\" && start "" "C:\inetpub\wwwroot\GH39\1krTM8\lvW6\BYes...
Creates the following services
- 'LqnIZf' cmd /c cd /d "C:\inetpub\wwwroot\GH39\1krTM8\lvW6\BYes\2dfSc\17rgPZ\Twulea\" && start "" "C:\inetpub\wwwroot\GH39\1krTM8\lvW6\BYes\2dfSc\17rgPZ\Twulea\vujtc.exe"
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'C:\inetpub\wwwroot\GH39\1krTM8\lvW6\BYes\2dfSc\17rgPZ\Twulea\'"
Modifies file system
Creates the following files
- %TEMP%\is-bewyot00ur.tmp\<File name>.tmp
- %TEMP%\is-mfg15w7r77.tmp\_isetup\_setup64.tmp
- C:\inetpub\wwwroot\gh39\1krtm8\lvw6\byes\2dfsc\17rgpz\bj8r\is-ijp7hu6fer.tmp
- C:\inetpub\wwwroot\gh39\1krtm8\lvw6\byes\2dfsc\17rgpz\bj8r\is-fosgzcq1io.tmp
- C:\inetpub\wwwroot\gh39\1krtm8\lvw6\byes\2dfsc\17rgpz\r2po1\is-504iy0jnns.tmp
- C:\inetpub\wwwroot\gh39\1krtm8\lvw6\byes\2dfsc\17rgpz\twulea\is-eilk0hwebx.tmp
- C:\inetpub\wwwroot\gh39\1krtm8\lvw6\byes\2dfsc\17rgpz\twulea\is-f9zqkulfoc.tmp
- C:\inetpub\wwwroot\gh39\1krtm8\lvw6\byes\2dfsc\17rgpz\twulea\is-y2qlkjc5n1.tmp
- %HOMEPATH%\desktop\sni paste.lnk
Deletes following files that it created itself
- %TEMP%\is-mfg15w7r77.tmp\_isetup\_setup64.tmp
- %TEMP%\is-bewyot00ur.tmp\<File name>.tmp
Moves the following files
- from C:\inetpub\wwwroot\gh39\1krtm8\lvw6\byes\2dfsc\17rgpz\bj8r\is-ijp7hu6fer.tmp to C:\inetpub\wwwroot\gh39\1krtm8\lvw6\byes\2dfsc\17rgpz\bj8r\azk0r.ico
- from C:\inetpub\wwwroot\gh39\1krtm8\lvw6\byes\2dfsc\17rgpz\bj8r\is-fosgzcq1io.tmp to C:\inetpub\wwwroot\gh39\1krtm8\lvw6\byes\2dfsc\17rgpz\bj8r\snipaste.exe
- from C:\inetpub\wwwroot\gh39\1krtm8\lvw6\byes\2dfsc\17rgpz\r2po1\is-504iy0jnns.tmp to C:\inetpub\wwwroot\gh39\1krtm8\lvw6\byes\2dfsc\17rgpz\r2po1\si.ico
- from C:\inetpub\wwwroot\gh39\1krtm8\lvw6\byes\2dfsc\17rgpz\twulea\is-eilk0hwebx.tmp to C:\inetpub\wwwroot\gh39\1krtm8\lvw6\byes\2dfsc\17rgpz\twulea\c.jv
- from C:\inetpub\wwwroot\gh39\1krtm8\lvw6\byes\2dfsc\17rgpz\twulea\is-f9zqkulfoc.tmp to C:\inetpub\wwwroot\gh39\1krtm8\lvw6\byes\2dfsc\17rgpz\twulea\vujtc.exe
- from C:\inetpub\wwwroot\gh39\1krtm8\lvw6\byes\2dfsc\17rgpz\twulea\is-y2qlkjc5n1.tmp to C:\inetpub\wwwroot\gh39\1krtm8\lvw6\byes\2dfsc\17rgpz\twulea\zbvgqc79.d
Network activity
UDP
- '<DNS_SERVER>':53
Miscellaneous
Creates and executes the following
- '%TEMP%\is-bewyot00ur.tmp\<File name>.tmp' /SL5="$F01F0,110861389,870912,<Full path to file>"
- 'C:\inetpub\wwwroot\gh39\1krtm8\lvw6\byes\2dfsc\17rgpz\twulea\vujtc.exe'
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Disable-NetAdapter -Name * -Confirm:$false"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Enable-NetAdapter -Name * -Confirm:$false"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Disable-NetAdapter -Name * -Confirm:$false"' (with hidden window)
- 'C:\inetpub\wwwroot\gh39\1krtm8\lvw6\byes\2dfsc\17rgpz\twulea\vujtc.exe' ' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Enable-NetAdapter -Name * -Confirm:$false"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'C:\inetpub\wwwroot\GH39\1krTM8\lvW6\BYes\2dfSc\17rgPZ\Twulea\'"' (with hidden window)
