Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Test' = '%WINDIR%\IDMregs.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\] 'AKSL startup' = '%WINDIR%\winsachia\1\2\3\2\1\2\config\888\kl.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServicesOnce\] 'AKSL startup' = '%WINDIR%\winsachia\1\2\3\2\1\2\config\888\kl.exe'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'AKSL startup' = '%WINDIR%\winsachia\1\2\3\2\1\2\config\888\kl.exe'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\] 'AKSL startup' = '%WINDIR%\winsachia\1\2\3\2\1\2\config\888\kl.exe'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Load' = '%WINDIR%\winsachia\1\2\3\2\1\2\config\888\kl.exe'
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'Run' = '%WINDIR%\winsachia\1\2\3\2\1\2\config\888\kl.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = 'userinit.exe,%WINDIR%\WINSAC~1\1\2\3\2\1\2\config\888\kl.exe'
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\SKLService] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\SKLService] 'ImagePath' = '%WINDIR%\winsachia\1\2\3\2\1\2\config\888\aklservice.exe'
Creates the following services
- 'SKLService' %WINDIR%\winsachia\1\2\3\2\1\2\config\888\aklservice.exe
Malicious functions
Launches a large number of processes
Installs hooks to intercept notifications
on keystrokes:
- Handler for all processes: %WINDIR%\winsachia\1\2\3\2\1\2\config\888\kl.dll
on window messages:
- Handler for all processes: %WINDIR%\winsachia\1\2\3\2\1\2\config\888\kl.dll
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
Modifies file system
Creates the following files
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %HOMEPATH%\data\timewait.txt
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %HOMEPATH%\data\data1.txt
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ym12ria1\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\igm0n8lj\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\jy8szmcm\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\1jd89het\desktop.ini
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %HOMEPATH%\data\datakey.txt
- %HOMEPATH%\data\head1.txt
- %HOMEPATH%\data\url5.txt
- %HOMEPATH%\data\datat1.txt
- %HOMEPATH%\data\datat2.txt
- %HOMEPATH%\data\datacoccoc.txt
- %HOMEPATH%\data\data2.txt
- %HOMEPATH%\data\dataweb.txt
- %HOMEPATH%\data\url2.txt
- %HOMEPATH%\data\head2.txt
- %HOMEPATH%\data\data3.txt
- %HOMEPATH%\data\url3.txt
- %HOMEPATH%\data\head3.txt
- %HOMEPATH%\data\data4.txt
- %HOMEPATH%\data\url4.txt
- %HOMEPATH%\data\head4.txt
- %HOMEPATH%\data\data5.txt
- %WINDIR%\logs\cancel\tmpemail.htm
- %HOMEPATH%\data\url1.txt
- %WINDIR%\logs\cancel\2024-12-16.htm
- %WINDIR%\image-g\logo-2.png
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %WINDIR%\syswow64\94e27569eb83.ini
- %WINDIR%\winsachia\1\2\3\2\1\2\config\888\kl.dll
- %WINDIR%\winsachia\1\2\3\2\1\2\config\888\kl.exe
- %WINDIR%\winsachia\1\2\3\2\1\2\config\888\kl.ini
- %WINDIR%\winsachia\1\2\3\2\1\2\config\888\lang\lang_en-us.lng
- %WINDIR%\winsachia\1\2\3\2\1\2\config\888\update\uw.exe
- %WINDIR%\idmdll.exe
- %WINDIR%\idmregs.exe
- %WINDIR%\request.exe
- %WINDIR%\startup.exe
- %WINDIR%\tai xiu gamvip.exe
- %WINDIR%\image-g\logo-1.png
- %WINDIR%\image-g\logo-2.jpg
- %WINDIR%\image-g\logo-3.jpg
- %WINDIR%\image-g\xocdiab.jpg
- %WINDIR%\image-g\logo-3.png
- %WINDIR%\image-g\logo-4.jpg
- %WINDIR%\image-g\logo-4.png
- %WINDIR%\image-g\logo-5.jpg
- %WINDIR%\image-g\logo-5.png
- %WINDIR%\image-g\logo-6.jpg
- %WINDIR%\image-g\logo-6.png
- %WINDIR%\image-g\logo-7.jpg
- %WINDIR%\image-g\logo-7.png
- %WINDIR%\image-g\logo-9.jpg
- %WINDIR%\image-g\logo-9.png
- %WINDIR%\image-g\rongho.jpg
- %WINDIR%\image-g\taixiu.jpg
- %WINDIR%\image-g\taixiub.jpg
- %WINDIR%\image-g\logo-1.jpg
- %HOMEPATH%\data\head5.txt
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ym12ria1\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\igm0n8lj\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\jy8szmcm\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\1jd89het\desktop.ini
Deletes the following files
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\_ir_sf_temp_0\irsetup.exe
Modifies the following files
Network activity
Connects to
- 'to##tx.club':80
TCP
HTTP GET requests
- http://to##tx.club/timewait.txt
- http://to##tx.club/randomdata5/web.txt
- http://to##tx.club/randomdata5/data.txt
- http://to##tx.club/randomdata4/head.txt
- http://to##tx.club/randomdata4/web.txt
- http://to##tx.club/randomdata4/data.txt
- http://to##tx.club/randomdata3/head.txt
- http://to##tx.club/randomdata3/web.txt
- http://to##tx.club/randomdata3/data.txt
- http://to##tx.club/randomdata2/head.txt
- http://to##tx.club/randomdata2/web.txt
- http://to##tx.club/dataweb.txt
- http://to##tx.club/randomdata2/data.txt
- http://to##tx.club/datacoccoc.txt
- http://to##tx.club/linkt2.txt
- http://to##tx.club/linkt1.txt
- http://to##tx.club/randomdata1/head.txt
- http://to##tx.club/randomdata1/web.txt
- http://to##tx.club/datakey.txt
- http://to##tx.club/randomdata1/data.txt
- http://to##tx.club/randomdata5/head.txt
- http://to##tx.club/randomdata6/data.txt
UDP
- DNS ASK google.com
- DNS ASK to##tx.club
- DNS ASK ch#####ip.populiser.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:719394 "__IRAFN:<Full path to file>" "__IRCT:2" "__IRTSS:0" "__IRSID:S-1-5-21-3691498038-2086406363-2140527554-1000"
- '%WINDIR%\winsachia\1\2\3\2\1\2\config\888\kl.exe'
- '%WINDIR%\startup.exe'
- '%WINDIR%\tai xiu gamvip.exe'
- '%WINDIR%\idmregs.exe'
- '%WINDIR%\idmdll.exe'
- '%WINDIR%\request.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\cacls.exe %WINDIR%\Logs\cancel /E /P users:F
- '%WINDIR%\syswow64\cacls.exe' %WINDIR%\Logs\cancel /E /P users:F
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' -Embedding
- '%WINDIR%\idmregs.exe' ' (with hidden window)
