Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im "<File name>.exe"
Modifies file system
Creates the following files
- %APPDATA%\logs\debug_log.txt
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<File name>.exe.log
- %HOMEPATH%\desktop\omega launcher.exe
- <Current directory>\logs\errorlogs.txt
Moves itself
- from <Full path to file> to <Current directory>\omega launcher.exe
Network activity
Connects to
- 'ap#.#pify.org':443
- 'ke##uth.win':443
TCP
Other
- 'ap#.#pify.org':443
UDP
- DNS ASK ap#.#pify.org
- DNS ASK ke##uth.win
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%HOMEPATH%\desktop\omega launcher.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im "<File name>.exe" & ren "<Full path to file>" "Omega Launcher.exe" & start "" "<Current directory>\Omega Launcher.exe"
- '%WINDIR%\syswow64\cmd.exe' /C choice /C Y /N /D Y /T 1 & Del "<Current directory>\Omega Launcher.exe"
- '%WINDIR%\syswow64\choice.exe' /C Y /N /D Y /T 1
- '%WINDIR%\syswow64\cmd.exe' /C choice /C Y /N /D Y /T 1 & Del "<Current directory>\Omega Launcher.exe"' (with hidden window)
