Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\] 'AKSL startup' = '%WINDIR%\SysWOW64\aol\kuxxxmxd\zoxxxaxsx\olss\kl.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServicesOnce\] 'AKSL startup' = '%WINDIR%\SysWOW64\aol\kuxxxmxd\zoxxxaxsx\olss\kl.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'AKSL startup' = '%WINDIR%\SysWOW64\aol\kuxxxmxd\zoxxxaxsx\olss\kl.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\] 'AKSL startup' = '%WINDIR%\SysWOW64\aol\kuxxxmxd\zoxxxaxsx\olss\kl.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%WINDIR%\SysWOW64\aol\kuxxxmxd\ZOXXXA~1\olss\kl.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%WINDIR%\SysWOW64\aol\kuxxxmxd\ZOXXXA~1\olss\kl.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = 'userinit.exe,%WINDIR%\SysWOW64\aol\kuxxxmxd\ZOXXXA~1\olss\kl.exe'
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\SKLService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\SKLService] 'ImagePath' = '%WINDIR%\SysWOW64\aol\kuxxxmxd\zoxxxaxsx\olss\aklservice.exe'
Creates the following services
- 'SKLService' %WINDIR%\SysWOW64\aol\kuxxxmxd\zoxxxaxsx\olss\aklservice.exe
Malicious functions
Installs hooks to intercept notifications
on keystrokes:
- Handler for all processes: %WINDIR%\SysWow64\aol\kuxxxmxd\zoxxxaxsx\olss\kl.dll
on window messages:
- Handler for all processes: %WINDIR%\SysWow64\aol\kuxxxmxd\zoxxxaxsx\olss\kl.dll
Modifies file system
Creates the following files
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %WINDIR%\syswow64\94e27569eb83.ini
- %WINDIR%\syswow64\aol\kuxxxmxd\zoxxxaxsx\olss\kl.dll
- %WINDIR%\syswow64\aol\kuxxxmxd\zoxxxaxsx\olss\kl.exe
- %WINDIR%\syswow64\aol\kuxxxmxd\zoxxxaxsx\olss\kl.ini
- %WINDIR%\syswow64\aol\kuxxxmxd\zoxxxaxsx\olss\lang\lang_en-us.lng
- %WINDIR%\syswow64\aol\kuxxxmxd\zoxxxaxsx\olss\update\uw.exe
- %WINDIR%\m88 setup.exe
- %APPDATA%\microsoft\windows\start menu\programs\windows\m88 for pc .lnk
- %TEMP%\is-1ukbc.tmp\m88 setup.tmp
- %TEMP%\is-f620n.tmp\_isetup\_setup64.tmp
Deletes the following files
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\_ir_sf_temp_0\irsetup.exe
Miscellaneous
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following
- '%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:653858 "__IRAFN:<Full path to file>" "__IRCT:2" "__IRTSS:0" "__IRSID:S-1-5-21-1960123792-2022915161-3775307078-1001"
- '%WINDIR%\syswow64\aol\kuxxxmxd\zoxxxaxsx\olss\kl.exe'
- '%WINDIR%\m88 setup.exe'
- '%TEMP%\is-1ukbc.tmp\m88 setup.tmp' /SL5="$14022C,1519524,721408,%WINDIR%\M88 setup.exe"
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\cacls.exe %WINDIR%\Logs\cancel /E /P users:F
- '%WINDIR%\syswow64\cacls.exe' %WINDIR%\Logs\cancel /E /P users:F
