Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\cHPbxsPx1F7d5o3rTQLk-i] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\cHPbxsPx1F7d5o3rTQLk-i] 'ImagePath' = 'cmd /c cd /d "C:\msys64\DK32Xm\sw1erS\oUZt\" && start "" "C:\msys64\DK32Xm\sw1erS\oUZt\PQnNT.exe"'
Creates the following services
- 'cHPbxsPx1F7d5o3rTQLk-i' cmd /c cd /d "C:\msys64\DK32Xm\sw1erS\oUZt\" && start "" "C:\msys64\DK32Xm\sw1erS\oUZt\PQnNT.exe"
Modifies file system
Creates the following files
- %TEMP%\is-s6975.tmp\<File name>.tmp
- %TEMP%\is-hnmh0.tmp\_isetup\_setup64.tmp
- C:\msys64\dk32xm\sw1ers\ouzt\is-2t8pm.tmp
- C:\msys64\dk32xm\sw1ers\ouzt\is-bh10a.tmp
- C:\msys64\dk32xm\sw1ers\ouzt\is-0ei9m.tmp
- %ALLUSERSPROFILE%\f1593f9392c141ffae3b924b193cbabd\config.ini
Deletes following files that it created itself
- %TEMP%\is-hnmh0.tmp\_isetup\_setup64.tmp
- %TEMP%\is-s6975.tmp\<File name>.tmp
Moves the following files
- from C:\msys64\dk32xm\sw1ers\ouzt\is-2t8pm.tmp to C:\msys64\dk32xm\sw1ers\ouzt\0r.n
- from C:\msys64\dk32xm\sw1ers\ouzt\is-bh10a.tmp to C:\msys64\dk32xm\sw1ers\ouzt\pqnnt.exe
- from C:\msys64\dk32xm\sw1ers\ouzt\is-0ei9m.tmp to C:\msys64\dk32xm\sw1ers\ouzt\zfo0.zzs
Network activity
Connects to
- 'fk###fhl.com':8080
- 'fk###fhl.com':80
UDP
- DNS ASK fk###fhl.com
Miscellaneous
Creates and executes the following
- '%TEMP%\is-s6975.tmp\<File name>.tmp' /SL5="$D02DE,19323750,868864,<Full path to file>"
- 'C:\msys64\dk32xm\sw1ers\ouzt\pqnnt.exe'
Executes the following
- 'C:\msys64\dk32xm\sw1ers\ouzt\pqnnt.exe' ' (with hidden window)
