Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\vlcassistant
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%APPDATA%\VLCAssistant','%HOMEPATH%\.007318de8a6a52b5\files'" > "%TEMP%\tsk_out.tmp
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="VLCAssistant" dir=in action=allow program="%APPDATA%\VLCAssistant\assistant.exe" enable=yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="VLCAssistant" dir=out action=allow program="%APPDATA%\VLCAssistant\assistant.exe" enable=yes
Modifies file system
Creates the following files
- %APPDATA%\vlcassistant\assistant.exe
- %HOMEPATH%\.007318de8a6a52b5\profile.tox
Network activity
Connects to
- 'ap#.#ountry.is':443
- '14#.#17.167.73':33445
- '20#.#85.115.131':53
- 'to##.mf-net.eu':33445
- '3.#.24.15':33445
- '13#.#62.110.188':33445
- '17#.#05.109.31':33445
- '17#.#04.215.182':33445
- 'to#.##astiras.org':33445
- '18#.#14.122.30':33445
- '95.##1.230.108':33445
- '18#.#45.84.166':33445
- '16#.#7.40.142':33445
TCP
Other
- 'ap#.#ountry.is':443
- '14#.#17.167.73':33445
- 'to##.mf-net.eu':33445
- '17#.#05.109.31':33445
- '17#.#04.215.182':33445
- '95.##1.230.108':33445
- '18#.#14.122.30':33445
- '18#.#45.84.166':33445
- '16#.#7.40.142':33445
UDP
- DNS ASK ap#.#ountry.is
- DNS ASK to##.mf-net.eu
- DNS ASK to#.##astiras.org
Miscellaneous
Creates and executes the following
- '%APPDATA%\vlcassistant\assistant.exe'
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Remove-Item 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run' -Recurse -Force -EA 0; Remove-ItemProperty 'HKCU:\Environment' -...
- '<SYSTEM32>\cmd.exe' /C "powershell -Command Add-MpPreference -ExclusionPath '%APPDATA%\VLCAssistant','%HOMEPATH%\.007318de8a6a52b5\files'" > "%TEMP%\tsk_out.tmp" 2>&1
- '%APPDATA%\vlcassistant\assistant.exe' ' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="VLCAssistant" dir=in action=allow program="%APPDATA%\VLCAssistant\assistant.exe" enable=yes' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="VLCAssistant" dir=out action=allow program="%APPDATA%\VLCAssistant\assistant.exe" enable=yes' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Remove-Item 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run' -Recurse -Force -EA 0; Remove-ItemProperty 'HKCU:\Environment' -...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "powershell -Command Add-MpPreference -ExclusionPath '%APPDATA%\VLCAssistant','%HOMEPATH%\.007318de8a6a52b5\files'" > "%TEMP%\tsk_out.tmp" 2>&1' (with hidden window)
