Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\browser service
Modifies file system
Creates the following files
- %TEMP%\etilqs_w6mdmdrtdh31vxe
Network activity
Connects to
- '17#.#11.174.107':80
- 'clients4.google.com':443
- 'tr######e.googleapis.com':443
- 'go##le.ru':80
- 'yo##ube.com':443
- '19#.#62.247.237':1377
- 'clients3.google.com':443
- 'go##le.ru':443
TCP
HTTP GET requests
- http://www.gs##tic.com/chrome/profile_avatars/NothingToDownload
HTTP POST requests
- http://17#.#11.174.107/Api/GetVersion/178BF1BF000406F1DF8E2D6D
- http://17#.#11.174.107/Api/GetTask/178BF1BF000406F1DF8E2D6D
Other
- 'clients2.google.com':443
- 'go###eapis.com':443
- 'yo##ube.com':443
- 'co####t.youtube.com':443
- 'go##le.ru':443
- 'google.com':443
UDP
- DNS ASK clients2.google.com
- DNS ASK clients4.google.com
- DNS ASK google.com
- DNS ASK go##le.ru
- DNS ASK go###eapis.com
- DNS ASK tr######e.googleapis.com
- DNS ASK gs##tic.com
- DNS ASK yo##ube.com
- DNS ASK clients3.google.com
- DNS ASK co####t.youtube.com
- 'google.com':443
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Google\Chrome\User Data'
Creates and executes the following
- '<SYSTEM32>\schtasks.exe' /create /sc MINUTE /mo 1 /tn "Browser service" /tr "<Full path to file>" /f' (with hidden window)
- '<Full path to file>' ' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /sc MINUTE /mo 1 /tn "Browser service" /tr "<Full path to file>" /f
- '<SYSTEM32>\taskeng.exe' {96BD74DA-20B8-4745-B2D0-5BA1E4E08474} S-1-5-21-1960123792-2022915161-3775307078-1001:plecmddpqokc\user:Interactive:[1]
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' https://www.yo##ube.com/watch?v=#######################
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=gpu-process --channel="2012.0.658421274\977760486" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-device-id=0x0000 --gpu-driver-vendor --gpu...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="BackgroundRendererProcesses/Disallow/BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/CaptivePo...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="BackgroundRendererProcesses/Disallow/*BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/CaptiveP...
