Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\CLJGTbp_] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\CLJGTbp_] 'ImagePath' = 'cmd /c cd /d "C:\msys64\Ai1xxf\9gyYLc\8nB9D\NqMdE\" && start "" "C:\msys64\Ai1xxf\9gyYLc\8nB9D\NqMdE\BTXX.exe"'
Creates the following services
- 'CLJGTbp_' cmd /c cd /d "C:\msys64\Ai1xxf\9gyYLc\8nB9D\NqMdE\" && start "" "C:\msys64\Ai1xxf\9gyYLc\8nB9D\NqMdE\BTXX.exe"
Modifies file system
Creates the following files
- %TEMP%\is-i70ss.tmp\<File name>.tmp
- %TEMP%\is-r5ea7.tmp\_isetup\_setup64.tmp
- C:\msys64\ai1xxf\9gyylc\8nb9d\nqmde\is-jhpv0.tmp
- C:\msys64\ai1xxf\9gyylc\8nb9d\nqmde\is-rm1v8.tmp
- C:\msys64\ai1xxf\9gyylc\8nb9d\nqmde\is-lbmpm.tmp
- %ALLUSERSPROFILE%\5b8bbd284e4f499fb422cbf3d72506f7\config.ini
- %ALLUSERSPROFILE%\d3623f1645ec4c86beea8ff670dec91e\config.ini
Deletes following files that it created itself
- %TEMP%\is-r5ea7.tmp\_isetup\_setup64.tmp
- %TEMP%\is-i70ss.tmp\<File name>.tmp
Moves the following files
- from C:\msys64\ai1xxf\9gyylc\8nb9d\nqmde\is-jhpv0.tmp to C:\msys64\ai1xxf\9gyylc\8nb9d\nqmde\btxx.exe
- from C:\msys64\ai1xxf\9gyylc\8nb9d\nqmde\is-rm1v8.tmp to C:\msys64\ai1xxf\9gyylc\8nb9d\nqmde\tst3uwr.np
- from C:\msys64\ai1xxf\9gyylc\8nb9d\nqmde\is-lbmpm.tmp to C:\msys64\ai1xxf\9gyylc\8nb9d\nqmde\uwnkza.jt
Network activity
Connects to
- '45.#19.98.6':25
- '9.###et.bond':443
- 'ei##oo5.com':80
- '9.###et.bond':80
- 'ap#.#ns.tools':443
- '9.###et.date':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0f##############
Other
- '9.###et.bond':443
- 'ei##oo5.com':80
- '9.###et.bond':80
- 'ap#.#ns.tools':443
UDP
- DNS ASK ei##oo5.com
- DNS ASK 9.###et.bond
- DNS ASK ap#.#ns.tools
- DNS ASK 9.###et.date
Miscellaneous
Creates and executes the following
- '%TEMP%\is-i70ss.tmp\<File name>.tmp' /SL5="$702C0,16432483,1152512,<Full path to file>"
- 'C:\msys64\ai1xxf\9gyylc\8nb9d\nqmde\btxx.exe'
Executes the following
- 'C:\msys64\ai1xxf\9gyylc\8nb9d\nqmde\btxx.exe' ' (with hidden window)
