Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\itwtYAzWlOZX] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\itwtYAzWlOZX] 'ImagePath' = 'cmd /c cd /d "C:\msys64\ZmfN\kPuen\" && start "" "C:\msys64\ZmfN\kPuen\3N7VQM1zo8Ee.exe"'
Creates the following services
- 'itwtYAzWlOZX' cmd /c cd /d "C:\msys64\ZmfN\kPuen\" && start "" "C:\msys64\ZmfN\kPuen\3N7VQM1zo8Ee.exe"
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'C:\msys64\ZmfN\kPuen\'"
Modifies file system
Creates the following files
- C:\msys64\zmfn\kpuen\1.v
- C:\msys64\zmfn\kpuen\3n7vqm1zo8ee.exe
- C:\msys64\zmfn\kpuen\sxvj5t.fyg
- %ALLUSERSPROFILE%\229e1b859cfe4897b2a79b56a6197aae\config.ini
Network activity
Connects to
- '18#.#6.88.242':22
UDP
- DNS ASK va##h.cn
Miscellaneous
Creates and executes the following
- 'C:\msys64\zmfn\kpuen\3n7vqm1zo8ee.exe'
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'C:\msys64\ZmfN\kPuen\'"' (with hidden window)
