Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring True; Set-MpPreference -DisableBehaviorMonitoring True; Set-MpPreference -DisableIOAVProtection True"
Modifies file system
Creates the following files
- %TEMP%\nylonx_time.hdr
- nul
- %TEMP%\nylonx_dbg.log
- <Current directory>\textkylggr
- %TEMP%\nylonx_hacked.bmp
Deletes following files that it created itself
- %TEMP%\nylonx_time.hdr
Modifies the following files
- %APPDATA%\microsoft\windows\themes\transcodedwallpaper
- %APPDATA%\microsoft\windows\themes\cachedfiles\cachedimage_1920_1080_pos2.jpg
Network activity
Connects to
- 'google.com':80
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK google.com
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c curl.exe -s --connect-timeout 3 --max-time 6 -D "%TEMP%\NylonX_time.hdr" -o NUL http://www.google.com
- '<SYSTEM32>\curl.exe' -s --connect-timeout 3 --max-time 6 -D "%TEMP%\NylonX_time.hdr" -o NUL http://www.google.com
- '<SYSTEM32>\cmd.exe' /c powershell -NoProfile -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring True; Set-MpPreference -DisableBehaviorMonitoring True; Set-MpPreference -DisableIOAVProtection Tr...
- '<SYSTEM32>\cmd.exe' /c curl.exe -s --connect-timeout 3 --max-time 6 -D "%TEMP%\NylonX_time.hdr" -o NUL http://www.google.com' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -NoProfile -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring True; Set-MpPreference -DisableBehaviorMonitoring True; Set-MpPreference -DisableIOAVProtection Tr...' (with hidden window)
