Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'Microsoft Office 2010 component' = '"%APPDATA%\Temp\MOComp.exe"'
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Modifies file system
Creates the following files
- %APPDATA%\temp\<File name>.exe
- %APPDATA%\recovery\opengl32sw.dll
- %APPDATA%\recovery\updt.exe
- %APPDATA%\recovery\winf.exe
- %APPDATA%\recovery\wsdriver.exe
- %APPDATA%\recovery\bin\rar.exe
- %APPDATA%\recovery\bin\res.rar
- %APPDATA%\recovery\iconengines\qsvgicon.dll
- %APPDATA%\recovery\imageformats\qgif.dll
- %APPDATA%\recovery\imageformats\qico.dll
- %APPDATA%\recovery\imageformats\qsvg.dll
- %APPDATA%\recovery\sqldrivers\qsqlpsql.dll
- %APPDATA%\recovery\platforms\qwindows.dll
- %APPDATA%\recovery\services\desktop services.exe
- %APPDATA%\recovery\services\libcurl-x64.dll
- %APPDATA%\recovery\services\libgcc_s_seh-1.dll
- %APPDATA%\recovery\services\libstdc++-6.dll
- %APPDATA%\recovery\services\libwinpthread-1.dll
- %APPDATA%\recovery\sqldrivers\qsqlite.dll
- %APPDATA%\recovery\sqldrivers\qsqlmysql.dll
- %APPDATA%\recovery\sqldrivers\qsqlodbc.dll
- %APPDATA%\recovery\mkeyt.exe
- %APPDATA%\recovery\imageformats\qjpeg.dll
- %APPDATA%\recovery\mkey.exe
- %APPDATA%\recovery\qt6gui.dll
- %APPDATA%\temp\libgcc_s_seh-1.dll
- %APPDATA%\temp\libstdc++-6.dll
- %APPDATA%\temp\libwinpthread-1.dll
- %APPDATA%\temp\qt6core.dll
- %APPDATA%\temp\qt6network.dll
- %APPDATA%\temp\wspaxx.exe
- %APPDATA%\temp\mocomp.exe
- %APPDATA%\recovery\d3dcompiler_47.dll
- %APPDATA%\recovery\qt6core.dll
- %APPDATA%\recovery\qt6network.dll
- %APPDATA%\recovery\libstdc++-6.dll
- %APPDATA%\recovery\qt6sql.dll
- %APPDATA%\recovery\qt6svg.dll
- %APPDATA%\recovery\qt6widgets.dll
- %APPDATA%\recovery\renci.sshnet.dll
- %APPDATA%\recovery\vc_redist.x64.exe
- %APPDATA%\recovery\libcrypto-1_1-x64.dll
- %APPDATA%\recovery\libgcc_s_seh-1.dll
- %APPDATA%\recovery\libmysql.dll
- %APPDATA%\recovery\libssl-1_1-x64.dll
- %APPDATA%\recovery\libwinpthread-1.dll
- %APPDATA%\recovery\styles\qwindowsvistastyle.dll
Network activity
Connects to
- 'mn###skutu.com':80
TCP
HTTP GET requests
- http://mn###skutu.com/mahzen4774/first/libgcc_s_seh-1.dll
- http://mn###skutu.com/mahzen4774/setup/opengl32sw.dll
- http://mn###skutu.com/mahzen4774/setup/updt.exe
- http://mn###skutu.com/mahzen4774/setup/winf.exe
- http://mn###skutu.com/mahzen4774/setup/wsdriver.exe
- http://mn###skutu.com/mahzen4774/setup/bin/Rar.exe
- http://mn###skutu.com/mahzen4774/setup/bin/res.rar
- http://mn###skutu.com/mahzen4774/setup/iconengines/qsvgicon.dll
- http://mn###skutu.com/mahzen4774/setup/imageformats/qgif.dll
- http://mn###skutu.com/mahzen4774/setup/imageformats/qico.dll
- http://mn###skutu.com/mahzen4774/setup/imageformats/qsvg.dll
- http://mn###skutu.com/mahzen4774/setup/sqldrivers/qsqlpsql.dll
- http://mn###skutu.com/mahzen4774/setup/platforms/qwindows.dll
- http://mn###skutu.com/mahzen4774/setup/services/Desktop%20Services.exe
- http://mn###skutu.com/mahzen4774/setup/services/libcurl-x64.dll
- http://mn###skutu.com/mahzen4774/setup/services/libgcc_s_seh-1.dll
- http://mn###skutu.com/mahzen4774/setup/services/libstdc++-6.dll
- http://mn###skutu.com/mahzen4774/setup/services/libwinpthread-1.dll
- http://mn###skutu.com/mahzen4774/setup/sqldrivers/qsqlite.dll
- http://mn###skutu.com/mahzen4774/setup/sqldrivers/qsqlmysql.dll
- http://mn###skutu.com/mahzen4774/setup/sqldrivers/qsqlodbc.dll
- http://mn###skutu.com/mahzen4774/setup/mkeyt.exe
- http://mn###skutu.com/mahzen4774/setup/imageformats/qjpeg.dll
- http://mn###skutu.com/mahzen4774/setup/mkey.exe
- http://mn###skutu.com/mahzen4774/setup/Qt6Gui.dll
- http://mn###skutu.com/mahzen4774/first/libstdc++-6.dll
- http://mn###skutu.com/mahzen4774/first/libwinpthread-1.dll
- http://mn###skutu.com/mahzen4774/first/Qt6Core.dll
- http://mn###skutu.com/mahzen4774/first/Qt6Network.dll
- http://mn###skutu.com/mahzen4774/first/wspaxx.exe
- http://mn###skutu.com/mahzen4774/first/MOComp.exe
- http://mn###skutu.com/mahzen4774/_hash.php
- http://mn###skutu.com/mahzen4774/setup/D3Dcompiler_47.dll
- http://mn###skutu.com/mahzen4774/setup/Qt6Core.dll
- http://mn###skutu.com/mahzen4774/setup/Qt6Network.dll
- http://mn###skutu.com/mahzen4774/setup/libstdc++-6.dll
- http://mn###skutu.com/mahzen4774/setup/Qt6Sql.dll
- http://mn###skutu.com/mahzen4774/setup/Qt6Svg.dll
- http://mn###skutu.com/mahzen4774/setup/Qt6Widgets.dll
- http://mn###skutu.com/mahzen4774/setup/Renci.SshNet.dll
- http://mn###skutu.com/mahzen4774/setup/VC_redist.x64.exe
- http://mn###skutu.com/mahzen4774/setup/libcrypto-1_1-x64.dll
- http://mn###skutu.com/mahzen4774/setup/libgcc_s_seh-1.dll
- http://mn###skutu.com/mahzen4774/setup/libmysql.dll
- http://mn###skutu.com/mahzen4774/setup/libssl-1_1-x64.dll
- http://mn###skutu.com/mahzen4774/setup/libwinpthread-1.dll
- http://mn###skutu.com/mahzen4774/setup/styles/qwindowsvistastyle.dll
UDP
- DNS ASK mn###skutu.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\temp\<File name>.exe' m mm m
- '%APPDATA%\temp\wspaxx.exe'
- '%APPDATA%\recovery\wsdriver.exe'
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Start-Process -FilePath C:/Users/user/AppData/Roaming/Recovery/wsdriver.exe -Verb RunAs
- '<SYSTEM32>\schtasks.exe' /Create /TN Microsoft\Windows\Security\WindowsSecurityDriver /XML sch.xml
- '<SYSTEM32>\schtasks.exe' /Change /TN Microsoft\Windows\Security\WindowsSecurityDriver /TR %APPDATA%\Recovery\wsdriver.exe /RU Users /RP ""
