Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '{A87D4C39-4A93-082F-0BFF-298F34A11CE5}' = '%APPDATA%\Weky\upovv.exe'
Malicious functions:
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Modifies file system:
Creates the following files:
- %TEMP%\14503386.ewgiwgukViaRu.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\a48f5e4c854778bae523cb4225f79856_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\gate[1].htm
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\fab4cd18ffe57b60cc8bd2287903c791_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\9cf34d66f8ed96c449d3bcce6ee0ee2d_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %ALLUSERSPROFILE%\Desktop\KEY
- %APPDATA%\Weky\upovv.exe
- %TEMP%\tmp_5e10990f.bat
- %TEMP%\bmpae35204b.bmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\d65e3ee954d5184c4d5e56b9e055a834_23ef5514-3059-436f-a4a7-4cefaab20eb1
Sets the 'hidden' attribute to the following files:
- %APPDATA%\Weky\upovv.exe
Deletes the following files:
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\a48f5e4c854778bae523cb4225f79856_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\9cf34d66f8ed96c449d3bcce6ee0ee2d_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\fab4cd18ffe57b60cc8bd2287903c791_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %TEMP%\14503386.ewgiwgukViaRu.exe
Network activity:
Connects to:
- 'i5######y5gzakmd.onion.link':80
- 'i5######y5gzakmd.onion.to':443
- 'i5######y5gzakmd.onion.sx':80
- 'i5######y5gzakmd.onion.top':443
- 'i5######y5gzakmd.onion.rip':443
- 'i5######y5gzakmd.onion.pw':80
TCP:
HTTP POST requests:
- http://i5######y5gzakmd.onion.link/gate
- http://i5######y5gzakmd.onion.sx/gate
- http://i5######y5gzakmd.onion.pw/gate
UDP:
- DNS ASK i5######y5gzakmd.onion.link
- DNS ASK i5######y5gzakmd.onion.to
- DNS ASK i5######y5gzakmd.onion.sx
- DNS ASK i5######y5gzakmd.onion.top
- DNS ASK i5######y5gzakmd.onion.rip
- DNS ASK i5######y5gzakmd.onion.pw
Miscellaneous:
Creates and executes the following:
- '%TEMP%\14503386.ewgiwgukViaRu.exe'
- '%APPDATA%\Weky\upovv.exe'
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe' /logtoconsole=false /logfile= /u "<Full path to file>"
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\tmp_5e10990f.bat"
