Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\14533620-1453-3620-1453-145336201450
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Modifies file system
Creates the following files
- %TEMP%\1013031715.js
- %TEMP%\191272195
- %LOCALAPPDATA%\145336200.js
- %TEMP%\1ed5f0f2
- %TEMP%\2d3f584c
- %TEMP%\zjzzlqkb.0.cs
- %TEMP%\zjzzlqkb.cmdline
- %TEMP%\zjzzlqkb.out
- %TEMP%\csc1e3a.tmp
- %TEMP%\res1e4a.tmp
- %TEMP%\zjzzlqkb.dll
Deletes the following files
- %TEMP%\1ed5f0f2
- %TEMP%\2d3f584c
- %TEMP%\res1e4a.tmp
- %TEMP%\csc1e3a.tmp
- %TEMP%\zjzzlqkb.0.cs
- %TEMP%\zjzzlqkb.pdb
- %TEMP%\zjzzlqkb.dll
- %TEMP%\zjzzlqkb.out
- %TEMP%\zjzzlqkb.cmdline
Moves the following files
- from %TEMP%\1013031715.js to %TEMP%\1ed5f0f2
- from %TEMP%\191272195 to %TEMP%\2d3f584c
Moves itself
- from <Full path to file> to <Current directory>\63275891
Deletes itself.
Network activity
Connects to
- 'a5###4fe.life':443
- '4e###a5c.xyz':443
TCP
Other
- '4e###a5c.xyz':443
UDP
- DNS ASK a5###4fe.xyz
- DNS ASK 0b###5fe.xyz
- DNS ASK 6c###898.art
- DNS ASK 6c###898.life
- DNS ASK 6c###898.xyz
- DNS ASK 35###159.art
- DNS ASK 35###159.life
- DNS ASK 35###159.xyz
- DNS ASK 90###a53.art
- DNS ASK 90###a53.life
- DNS ASK 90###a53.xyz
- DNS ASK 19###3ba.art
- DNS ASK 19###3ba.life
- DNS ASK 19###3ba.xyz
- DNS ASK 04###168.art
- DNS ASK 04###168.life
- DNS ASK 04###168.xyz
- DNS ASK 34###d56.art
- DNS ASK 34###d56.life
- DNS ASK 34###d56.xyz
- DNS ASK 41###27a.art
- DNS ASK 41###27a.life
- DNS ASK 41###27a.xyz
- DNS ASK 4e###a5c.art
- DNS ASK 4e###a5c.life
- DNS ASK 4e###a5c.xyz
- DNS ASK a5###4fe.art
- DNS ASK a5###4fe.life
- DNS ASK 0b###5fe.life
- DNS ASK 0b###5fe.art
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\1013031715.js" "<Full path to file>"
- '<SYSTEM32>\wscript.exe' "%LOCALAPPDATA%\145336200.js"
- '%WINDIR%\syswow64\vssadmin.exe' Delete Shadows /All /Quiet' (with hidden window)
- '<SYSTEM32>\wscript.exe' "%LOCALAPPDATA%\145336200.js"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -NonI -W Hidden -Exec Bypass -enc QQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsAdQBzAGkAbgBnACAATQBpAGMAcgBvAHMAbwBmAHQALg...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\zjzzlqkb.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1E4A.tmp" "%TEMP%\CSC1E3A.tmp"' (with hidden window)
Executes the following
- '<SYSTEM32>\taskeng.exe' {3E26C5AE-3BDC-46D8-8455-D702B0D5B120} S-1-5-21-1960123792-2022915161-3775307078-1001:qahhkyugvlb\user:Interactive:[1]
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -NonI -W Hidden -Exec Bypass -enc QQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsAdQBzAGkAbgBnACAATQBpAGMAcgBvAHMAbwBmAHQALg...
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\zjzzlqkb.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1E4A.tmp" "%TEMP%\CSC1E3A.tmp"
