Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\MsRkNrL] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\MsRkNrL] 'ImagePath' = '<SYSTEM32>\wscript.exe //B "C:\autoexec.vbs"'
Creates the following services
- 'MsRkNrL' <SYSTEM32>\wscript.exe //B "C:\autoexec.vbs"
Malicious functions
Creates and executes the following (exploit)
- '<SYSTEM32>\wscript.exe' //B "%TEMP%\rknrl.vbs"
Modifies file system
Creates the following files
- %TEMP%\dm6331.tmp
- %TEMP%\rknrl.vbs
- %TEMP%\winstart.vbs
Network activity
Connects to
- 'ap#.##herscan.io':80
- 'a1.##s6.club':80
TCP
HTTP GET requests
- http://ap#.##herscan.io/api?mo#############################################################################
- http://a1.##s6.club/ctrl/url.html
UDP
- DNS ASK ap#.##herscan.io
- DNS ASK ai########ill.aigoingtokill.club
- DNS ASK a1.##s6.club
- DNS ASK a1.####botheworld.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' //B "%TEMP%\winstart.vbs"
- '<SYSTEM32>\wscript.exe' //B "%TEMP%\rknrl.vbs"' (with hidden window)
