Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /im "<File name>.exe" /f
- '%WINDIR%\syswow64\taskkill.exe' /im "of0xt93BHA=.exe" /f
Modifies file system
Creates the following files
- <Current directory>\of0xt93bha=.exe
Deletes the following files
- <Current directory>\of0xt93bha=.exe
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://wi###clean.hk/bus
UDP
- DNS ASK wi###clean.hk
- DNS ASK sp####ishltd.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<Current directory>\of0xt93bha=.exe'
- '%WINDIR%\syswow64\cmd.exe' /c start /I "" "<Current directory>\of0xt93BHA=.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "<File name>.exe" /f & erase "<Full path to file>" & exit' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "of0xt93BHA=.exe" /f & erase "<Current directory>\of0xt93BHA=.exe" & exit' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c start /I "" "<Current directory>\of0xt93BHA=.exe"
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "<File name>.exe" /f & erase "<Full path to file>" & exit
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "of0xt93BHA=.exe" /f & erase "<Current directory>\of0xt93BHA=.exe" & exit
