Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAdQBzAGUAcgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABqAH...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACgAJwBDADoAXABVAHMAZQByAHMAXAB1AHMAZQByAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAG...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAQwA6AFwAVQBzAGUAcgBzAFwAdQBzAGUAcgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAG...
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %TEMP%\7zs04f37dce\chrome_100_percent.pak
- %TEMP%\7zs04f37dce\chrome_200_percent.pak
- %TEMP%\7zs04f37dce\icudtl.dat
- %TEMP%\7zs04f37dce\license
- %TEMP%\7zs04f37dce\licenses.chromium.html
- %TEMP%\7zs04f37dce\locales\af.pak
- %TEMP%\7zs04f37dce\locales\am.pak
- %TEMP%\7zs04f37dce\locales\ar.pak
- %TEMP%\7zs04f37dce\locales\bg.pak
- %TEMP%\7zs04f37dce\locales\bn.pak
- %TEMP%\7zs04f37dce\locales\ca.pak
- %TEMP%\7zs04f37dce\locales\cs.pak
- %TEMP%\7zs04f37dce\locales\da.pak
- %TEMP%\7zs04f37dce\locales\de.pak
- %TEMP%\7zs04f37dce\locales\el.pak
- %TEMP%\7zs04f37dce\locales\en-gb.pak
- %TEMP%\7zs04f37dce\locales\en-us.pak
- %TEMP%\7zs04f37dce\locales\es-419.pak
- %TEMP%\7zs04f37dce\locales\es.pak
- %TEMP%\7zs04f37dce\locales\et.pak
- %TEMP%\7zs04f37dce\locales\fa.pak
- %TEMP%\7zs04f37dce\locales\fi.pak
- %TEMP%\7zs04f37dce\locales\fil.pak
- %TEMP%\7zs04f37dce\locales\fr.pak
- %TEMP%\7zs04f37dce\locales\gu.pak
- %TEMP%\7zs04f37dce\locales\he.pak
- %TEMP%\7zs04f37dce\locales\hi.pak
- %TEMP%\7zs04f37dce\locales\hr.pak
- %TEMP%\7zs04f37dce\locales\hu.pak
- %TEMP%\7zs04f37dce\locales\id.pak
- %TEMP%\7zs04f37dce\locales\it.pak
- %TEMP%\7zs04f37dce\locales\ja.pak
- %TEMP%\7zs04f37dce\locales\kn.pak
- %TEMP%\7zs04f37dce\locales\ko.pak
- %TEMP%\7zs04f37dce\locales\lt.pak
- %TEMP%\7zs04f37dce\locales\lv.pak
- %TEMP%\7zs04f37dce\locales\ml.pak
- %TEMP%\7zs04f37dce\locales\mr.pak
- %TEMP%\7zs04f37dce\locales\ms.pak
- %TEMP%\7zs04f37dce\locales\nb.pak
- %TEMP%\7zs04f37dce\locales\nl.pak
- %TEMP%\7zs04f37dce\locales\pl.pak
- %TEMP%\7zs04f37dce\locales\pt-br.pak
- %TEMP%\7zs04f37dce\locales\pt-pt.pak
- %TEMP%\7zs04f37dce\locales\ro.pak
- %TEMP%\7zs04f37dce\locales\ru.pak
- %TEMP%\7zs04f37dce\locales\sk.pak
- %TEMP%\7zs04f37dce\locales\sl.pak
- %TEMP%\7zs04f37dce\locales\sr.pak
- %TEMP%\7zs04f37dce\locales\sv.pak
- %TEMP%\7zs04f37dce\locales\sw.pak
- %TEMP%\7zs04f37dce\locales\ta.pak
- %TEMP%\7zs04f37dce\locales\te.pak
- %TEMP%\7zs04f37dce\locales\th.pak
- %TEMP%\7zs04f37dce\locales\tr.pak
- %TEMP%\7zs04f37dce\locales\uk.pak
- %TEMP%\7zs04f37dce\locales\ur.pak
- %TEMP%\7zs04f37dce\locales\vi.pak
- %TEMP%\7zs04f37dce\locales\zh-cn.pak
- %TEMP%\7zs04f37dce\locales\zh-tw.pak
- %TEMP%\7zs04f37dce\resources\app.asar
- %TEMP%\7zs04f37dce\resources.pak
- %TEMP%\7zs04f37dce\snapshot_blob.bin
- %TEMP%\7zs04f37dce\v8_context_snapshot.bin
- %TEMP%\7zs04f37dce\version
- %TEMP%\7zs04f37dce\vk_swiftshader_icd.json
- %TEMP%\7zs04f37dce\d3dcompiler_47.dll
- %TEMP%\7zs04f37dce\ffmpeg.dll
- %TEMP%\7zs04f37dce\libegl.dll
- %TEMP%\7zs04f37dce\libglesv2.dll
- %TEMP%\7zs04f37dce\lksggtiexrc.exe
- %TEMP%\7zs04f37dce\vk_swiftshader.dll
- %TEMP%\7zs04f37dce\vulkan-1.dll
- nul
- %APPDATA%\lksggtiexrc\4f2d700a-7b59-4c59-8e75-3a22bbe5dbb1.tmp
- %LOCALAPPDATA%\jtet\bjsxkjys\ljtsowjvjl\devrdzbf\jhqacbfc\bbiqmrt\egiacd\enwrmu\mcuyell\dpcuu\ycpdfce.exe
Deletes following files that it created itself
- %LOCALAPPDATA%\jtet\bjsxkjys\ljtsowjvjl\devrdzbf\jhqacbfc\bbiqmrt\egiacd\enwrmu\mcuyell\dpcuu\ycpdfce.exe
Moves the following files
- from %APPDATA%\lksggtiexrc\4f2d700a-7b59-4c59-8e75-3a22bbe5dbb1.tmp to %APPDATA%\lksggtiexrc\local state
Network activity
Connects to
- 'dn#.google':443
- 'st###.#intergroup.one':443
- 'x1.#.lencr.org':80
- 'x2.#.lencr.org':80
- 'ye.#.lencr.org':80
- 'ye#.#.lencr.org':80
- 'ap#.#elegra.ph':443
- 'po##.##i.pocket.network':443
- 'yr.#.lencr.org':80
- 'yr#.#.lencr.org':80
TCP
HTTP GET requests
- http://x2.#.lencr.org/
- http://ye.#.lencr.org/
- http://ye#.#.lencr.org/50.crl
- http://yr.#.lencr.org/
- http://yr#.#.lencr.org/22.crl
Other
- 'dn#.google':443
- 'st###.#intergroup.one':443
- 'po##.##i.pocket.network':443
UDP
- DNS ASK dn#.google
- DNS ASK st###.#intergroup.one
- DNS ASK x1.#.lencr.org
- DNS ASK x2.#.lencr.org
- DNS ASK ye.#.lencr.org
- DNS ASK ye#.#.lencr.org
- DNS ASK ap#.#elegra.ph
- DNS ASK po##.##i.pocket.network
- DNS ASK yr.#.lencr.org
- DNS ASK yr#.#.lencr.org
Miscellaneous
Creates and executes the following
- '%TEMP%\7zs04f37dce\lksggtiexrc.exe'
- '%TEMP%\7zs04f37dce\lksggtiexrc.exe' --type=gpu-process --no-sandbox --user-data-dir="%APPDATA%\lksggtiexrc" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAA...
- '%TEMP%\7zs04f37dce\lksggtiexrc.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="%APPDATA%\lksggtiexrc" --mojo-platform-channel-handle=1864 ...
- '%LOCALAPPDATA%\jtet\bjsxkjys\ljtsowjvjl\devrdzbf\jhqacbfc\bbiqmrt\egiacd\enwrmu\mcuyell\dpcuu\ycpdfce.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -EncodedCommand CgAgACAAIAAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBPAHUAdABwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABp...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -EncodedCommand CgAgACAAIAAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBPAHUAdABwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwBdADoAOgBuAG...
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -EncodedCommand CgAgACAAIAAgACQAcAByAGkAbgBjAGkAcABhAGwAIAA9ACAAWwBTAGUAYwB1AHIAaQB0AHkALgBQAHIAaQBuAGMAaQBwAGEAbAAuAFcAaQBuAGQAbwB3AHMAUAByAGkAbgBjAGkAcABhAGwAXQBb...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -EncodedCommand CgAgACAAIAAgACQAcAByAGkAbgBjAGkAcABhAGwAIAA9ACAAWwBTAGUAYwB1AHIAaQB0AHkALgBQAHIAaQBuAGMAaQBwAGEAbAAuAFcAaQBuAGQAbwB3AHMAUAByAGkAbgBjAGkAcABhAGwAXQBbAFMAZQBjAHUAcgBpAH...
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAdQBzAGUAcgBcAEEAcABwAEQAYQB0AGEAXABM...
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACgAJwBDADoAXABVAHMAZQByAHMAXAB1AHMAZQByAFwAQQBwAHAARABh...
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAQwA6AFwAVQBzAGUAcgBzAFwAdQBzAGUAcgBcAEEAcABwAEQAYQB0...
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -EncodedCommand CgAgACAAIAAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBPAHUAdABwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABp...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -EncodedCommand CgAgACAAIAAgACQAcAByAGkAbgBjAGkAcABhAGwAIAA9ACAAWwBTAGUAYwB1AHIAaQB0AHkALgBQAHIAaQBuAGMAaQBwAGEAbAAuAFcAaQBuAGQAbwB3AHMAUAByAGkAbgBjAGkAcABhAGwAXQBb...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAdQBzAGUAcgBcAEEAcABwAEQAYQB0AGEAXABM...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACgAJwBDADoAXABVAHMAZQByAHMAXAB1AHMAZQByAFwAQQBwAHAARABh...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell.exe -NoProfile -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAQwA6AFwAVQBzAGUAcgBzAFwAdQBzAGUAcgBcAEEAcABwAEQAYQB0...' (with hidden window)
- '%LOCALAPPDATA%\jtet\bjsxkjys\ljtsowjvjl\devrdzbf\jhqacbfc\bbiqmrt\egiacd\enwrmu\mcuyell\dpcuu\ycpdfce.exe' ' (with hidden window)
