Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, <Full path to file>'
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
- User Account Control (UAC)
- Windows Recovery Environment (WinRE)
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '<Current directory>' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath '%WINDIR%' -ErrorAction SilentlyCon...
Modifies file system
Creates the following files
- %APPDATA%\winsvc\bguard.exe
- %APPDATA%\winsvc\berserk.exe
- %APPDATA%\winsvc\xor.log
Network activity
Connects to
- '10#.#65.155.43':29170
- '10#.#65.155.43':8081
- '93.##2.223.47':80
- '93.##2.223.245':29170
TCP
HTTP GET requests
Other
- '10#.#65.155.43':8081
UDP
- DNS ASK st###m.local
Miscellaneous
Adds a root certificate
Modifies value of AutoConfigURL parameter to 'http://93.152.223.47/proxy.pac'
Searches for the following windows
- ClassName: '' WindowName: 'Steam Support'
Creates and executes the following
- '%APPDATA%\winsvc\bguard.exe'
- '%APPDATA%\winsvc\berserk.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c powercfg -change -standby-timeout-ac 0 & powercfg -change -standby-timeout-dc 0 & powercfg -change -monitor-timeout-ac 0 & powercfg -change -monitor-timeout-dc 0 & powercfg -change -hibernat...
- '<SYSTEM32>\powercfg.exe' -change -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' -change -standby-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' -change -monitor-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' -change -monitor-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' -change -hibernate-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' -change -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' -h off
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -EncodedCommand WwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBEAGUAZgBhAHUAbAB0AFcAZQBiAFAAcgBvAHgAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUw...
- '<SYSTEM32>\reagentc.exe' /disable
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '<Current directory>' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath '%WINDIR%' -ErrorAction SilentlyCon...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powercfg -change -standby-timeout-ac 0 & powercfg -change -standby-timeout-dc 0 & powercfg -change -monitor-timeout-ac 0 & powercfg -change -monitor-timeout-dc 0 & powercfg -change -hibernat...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -EncodedCommand WwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBEAGUAZgBhAHUAbAB0AFcAZQBiAFAAcgBvAHgAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUw...' (with hidden window)
