Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- C:\åðò£»ðáú20240407\åðò£»ðáú20240407.exe
- D:\åðò£»ðáú202402\wusheng\map\0134.map
- D:\åðò£»ðáú202402\wusheng\map\0135.map
- D:\åðò£»ðáú202402\wusheng\map\0136.map
- D:\åðò£»ðáú202402\wusheng\map\0137.map
- D:\åðò£»ðáú202402\wusheng\map\0138.map
- D:\åðò£»ðáú202402\wusheng\map\0139.map
- D:\åðò£»ðáú202402\wusheng\map\0149.map
- D:\åðò£»ðáú202402\wusheng\map\0140.map
- D:\åðò£»ðáú202402\wusheng\map\0142.map
- D:\åðò£»ðáú202402\wusheng\map\0143.map
- D:\åðò£»ðáú202402\wusheng\map\0144.map
- D:\åðò£»ðáú202402\wusheng\map\0145.map
- D:\åðò£»ðáú202402\wusheng\map\0146.map
- D:\åðò£»ðáú202402\wusheng\map\0147.map
- D:\åðò£»ðáú202402\wusheng\map\0132.map
- D:\åðò£»ðáú202402\wusheng\map\0133.map
- D:\åðò£»ðáú202402\wusheng\map\0141.map
- D:\åðò£»ðáú202402\wusheng\map\0148.map
- D:\åðò£»ðáú202402\wusheng\map\012a.map
- D:\åðò£»ðáú202402\wusheng\map\0117.map
- D:\åðò£»ðáú202402\wusheng\map\0118.map
- D:\åðò£»ðáú202402\wusheng\map\0119.map
- D:\åðò£»ðáú202402\wusheng\map\0120.map
- D:\åðò£»ðáú202402\wusheng\map\0121.map
- D:\åðò£»ðáú202402\wusheng\map\0122.map
- D:\åðò£»ðáú202402\wusheng\map\0123.map
- D:\åðò£»ðáú202402\wusheng\map\0124.map
- D:\åðò£»ðáú202402\wusheng\map\0125.map
- D:\åðò£»ðáú202402\wusheng\map\0126.map
- D:\åðò£»ðáú202402\wusheng\map\0127.map
- D:\åðò£»ðáú202402\wusheng\map\0128.map
- D:\åðò£»ðáú202402\wusheng\map\0129.map
- D:\åðò£»ðáú202402\wusheng\map\0130.map
- D:\åðò£»ðáú202402\wusheng\map\01152.map
- D:\åðò£»ðáú202402\wusheng\map\0131.map
- D:\åðò£»ðáú202402\data\magic2.wzx
- D:\åðò£»ðáú202402\wusheng\map\0150.map
- D:\åðò£»ðáú202402\wusheng\map\1001.map
- D:\åðò£»ðáú202402\wusheng\map\1003.map
- D:\åðò£»ðáú202402\wusheng\map\1004.map
- D:\åðò£»ðáú202402\wusheng\map\1005.map
- D:\åðò£»ðáú202402\wusheng\map\1006.map
- D:\åðò£»ðáú202402\wusheng\map\1007.map
- D:\åðò£»ðáú202402\wusheng\map\10123.map
- D:\åðò£»ðáú202402\wusheng\map\0151.map
- D:\åðò£»ðáú202402\wusheng\map\11.map
- D:\åðò£»ðáú202402\wusheng\map\12.map
- D:\åðò£»ðáú202402\wusheng\map\2.map
- D:\åðò£»ðáú202402\wusheng\map\28.map
- D:\åðò£»ðáú202402\wusheng\map\3.map
- D:\åðò£»ðáú202402\wusheng\map\3~1.map
- D:\åðò£»ðáú202402\wusheng\map\1.map
- D:\åðò£»ðáú202402\wusheng\map\0~5.map
- D:\åðò£»ðáú202402\wusheng\map\1002.map
- D:\åðò£»ðáú202402\wusheng\map\06578.map
- D:\åðò£»ðáú202402\wusheng\map\06577.map
- D:\åðò£»ðáú202402\wusheng\map\0152.map
- D:\åðò£»ðáú202402\wusheng\map\0154.map
- D:\åðò£»ðáú202402\wusheng\map\0155.map
- D:\åðò£»ðáú202402\wusheng\map\0156.map
- D:\åðò£»ðáú202402\wusheng\map\0157.map
- D:\åðò£»ðáú202402\wusheng\map\0158.map
- D:\åðò£»ðáú202402\wusheng\map\0115.map
- D:\åðò£»ðáú202402\wusheng\map\0159.map
- D:\åðò£»ðáú202402\wusheng\map\0116.map
- D:\åðò£»ðáú202402\wusheng\map\0161.map
- D:\åðò£»ðáú202402\wusheng\map\0170.map
- D:\åðò£»ðáú202402\wusheng\map\0171.map
- D:\åðò£»ðáú202402\wusheng\map\03408.map
- D:\åðò£»ðáú202402\wusheng\map\06575.map
- D:\åðò£»ðáú202402\wusheng\map\06576.map
- D:\åðò£»ðáú202402\wusheng\map\0160.map
- D:\åðò£»ðáú202402\wusheng\map\0153.map
- D:\åðò£»ðáú202402\wusheng\map\0162.map
- D:\åðò£»ðáú202402\wusheng\map\01142.map
- D:\åðò£»ðáú202402\wusheng\map\01141.map
- D:\åðò£»ðáú202402\wusheng\map\0114.map
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\bullet[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\down[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\navcancl[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\background_gradient[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\bullet[1]
- %ALLUSERSPROFILE%\rr.exe
- D:\åðò£»ðáú202402\17220åðò£»ðáú20240407.exe
- %TEMP%\del.dat
- %TEMP%\ec44f51501ac5cd56542597a05fe5ac2.txt
- %ALLUSERSPROFILE%\playtomenu.jpg
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\bullet[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\background_gradient[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\bullet[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\dnserrordiagoff_weboc[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\errorpagestrings[1]
- %TEMP%\ii.html
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\background_gradient[1]
- D:\åðò£»ðáú202402\1.ico
- D:\åðò£»ðáú202402\wusheng\map\3~2.map
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\navcancl[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\dnserrordiagoff_weboc[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\background_gradient[1]
- C:\åðò£»ðáú20240407\1.ico
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\down[1]
- D:\åðò£»ðáú202402\wusheng\map\1111.map
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\navcancl[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\errorpagestrings[1]
- D:\åðò£»ðáú202402\wusheng\map\0102.map
- D:\åðò£»ðáú202402\wusheng\map\0103.map
- D:\åðò£»ðáú202402\wusheng\map\0104.map
- D:\åðò£»ðáú202402\wusheng\map\0105.map
- D:\åðò£»ðáú202402\wusheng\map\0106.map
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\httperrorpagesscripts[1]
- D:\åðò£»ðáú202402\wusheng\map\0107.map
- D:\åðò£»ðáú202402\wusheng\map\0109.map
- D:\åðò£»ðáú202402\wusheng\map\0110.map
- D:\åðò£»ðáú202402\wusheng\map\0111.map
- D:\åðò£»ðáú202402\wusheng\map\0112.map
- D:\åðò£»ðáú202402\wusheng\map\0113.map
- D:\åðò£»ðáú202402\wusheng\map\01132.map
- D:\åðò£»ðáú202402\wusheng\map\0014.map
- D:\åðò£»ðáú202402\wusheng\map\0108.map
- D:\åðò£»ðáú202402\wusheng\map\0101.map
- D:\åðò£»ðáú202402\wusheng\map\0100.map
- D:\åðò£»ðáú202402\wusheng\map\0006.map
- D:\åðò£»ðáú202402\wusheng\map\00000.map
- %ALLUSERSPROFILE%\playtomenu.exe
- D:\åðò£»ðáú202402\åðò£»ðáú20240407.lnk
- %HOMEPATH%\desktop\åðò£»ðáú20240407.lnk
- %TEMP%\1e6d937384271d2609e89020485cc435.ini
- %TEMP%\²¹¶¡.zip
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\errorpagetemplate[1]
- D:\åðò£»ðáú202402\data\magic2.wzl
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
- D:\åðò£»ðáú202402\data\magic5.wzl
- D:\åðò£»ðáú202402\data\magic6.wzl
- D:\åðò£»ðáú202402\data\magic6.wzx
- D:\åðò£»ðáú202402\data\mapdesc2.dat
- D:\åðò£»ðáú202402\wusheng\data\esp_ng.dat
- D:\åðò£»ðáú202402\wusheng\map\0.map
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\dnserrordiagoff_weboc[1]
- <Current directory>\delself.cmd
- D:\åðò£»ðáú202402\data\magic5.wzx
- D:\åðò£»ðáú202402\wusheng\map\3~3.map
Deletes the following files
- C:\åðò£»ðáú20240407\1.ico
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\background_gradient[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\bullet[1]
- D:\åðò£»ðáú202402\1.ico
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\dnserrordiagoff_weboc[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\navcancl[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\background_gradient[1]
- %ALLUSERSPROFILE%\playtomenu.jpg
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\bullet[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\navcancl[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\errorpagetemplate[1]
- %TEMP%\1e6d937384271d2609e89020485cc435.ini
- %ALLUSERSPROFILE%\rr.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\bullet[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\dnserrordiagoff_weboc[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\background_gradient[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\navcancl[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\background_gradient[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\bullet[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\down[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\errorpagetemplate[1]
- <Current directory>\delself.cmd
Moves the following files
- from D:\åðò£»ðáú202402\åðò£»ðáú20240407.lnk to %HOMEPATH%\desktop\åðò£»ðáú20240407.lnk
Substitutes the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\dnserrordiagoff_weboc[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\background_gradient[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\bullet[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\navcancl[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\background_gradient[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\bullet[1]
Deletes itself.
Network activity
Connects to
- 'd_#.##rgesder.com':8888
- 'r.###gesder.com':8888
- 'pl######nu.largesder.com':8888
- '10#.#3.144.72':99
- 'st###.wodebd.com':3798
- 'd3.###gesder.com':8888
TCP
HTTP GET requests
- http://d_#.###gesder.com:8888/ via d_#.##rgesder.com
- http://r.#####sder.com:8888/R.jpg
- http://pl#######u.largesder.com:8888/playtomenu.jpg
- http://10#.##.144.72:99/%E9%80%8D%E9%81%A5%E7%81%AB%E9%BE%99.txt via 10#.#3.144.72
- http://10#.##.144.72:99/%E5%D0%D2%A3%BB%F0%C1%FA.txt via 10#.#3.144.72
- http://d3.###gesder.com/shell/?pa############################################################################
UDP
- DNS ASK d_#.##rgesder.com
- DNS ASK r.###gesder.com
- DNS ASK pl######nu.largesder.com
- DNS ASK st###.wodebd.com
- DNS ASK d3.###gesder.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- 'C:\åðò£»ðáú20240407\åðò£»ðáú20240407.exe'
- 'D:\åðò£»ðáú202402\17220åðò£»ðáú20240407.exe'
- '%ALLUSERSPROFILE%\rr.exe' -y x -pFASJKLVFDAJKLCDSA434JKLFDS "%ALLUSERSPROFILE%\playtomenu.jpg" "%ALLUSERSPROFILE%\"
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c delself.cmd
- '%ALLUSERSPROFILE%\rr.exe' -y x -pFASJKLVFDAJKLCDSA434JKLFDS "%ALLUSERSPROFILE%\playtomenu.jpg" "%ALLUSERSPROFILE%\"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c delself.cmd' (with hidden window)
