Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %WINDIR%\tasks\suker.job
- <SYSTEM32>\tasks\mljjichbe
Modifies file system
Creates the following files
- C:\oj0fdhb\tscdstau.exe
- C:\oj0fdhb\weshzzy5.exe
- C:\oj0fdhb\qxxjbcdq.zip
- C:\oj0fdhb\jrxs6rac.exe
- C:\oj0fdhb\neljqnkb.exe
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_d99ef00b-ccd3-4f1d-9980-90ac453b0b47
- %TEMP%\mszpg5w.bat
- %TEMP%\work\7z.exe
- %TEMP%\work\cecho.exe
- %TEMP%\work\dkt.zip
- %TEMP%\work\nircmd.exe
- %TEMP%\work\nsudolg.exe
- %TEMP%\bd4cae89c3\suker.exe
- nul
Network activity
Connects to
- '17#.#6.157.50':80
TCP
HTTP POST requests
- http://17#.#6.157.50/tu3d2rom/index.php
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- 'C:\oj0fdhb\tscdstau.exe'
- 'C:\oj0fdhb\weshzzy5.exe' x -aoa -bso0 -bsp1 "C:\OJ0fdHb\qXxjBCDQ.zip" -pnrRtE6fe -o"C:\OJ0fdHb"
- 'C:\oj0fdhb\neljqnkb.exe'
- 'C:\oj0fdhb\jrxs6rac.exe'
- '%TEMP%\bd4cae89c3\suker.exe'
- '%TEMP%\work\nircmd.exe' win min process "cmd.exe"
- '%TEMP%\work\nsudolg.exe' -U:T -P:E -UseCurrentConsole "%TEMP%\mszPG5W.bat" any_word
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\OJ0fdHb\WEsHZzy5.exe" x -aoa -bso0 -bsp1 "C:\OJ0fdHb\qXxjBCDQ.zip" -pnrRtE6fe -o"C:\OJ0fdHb""
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /tn "MljJiCHBe" /tr "C:\OJ0fdHb\TSCDstAU.exe" /sc minute /mo 10 /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "MljJiCHBe" /tr "C:\OJ0fdHb\TSCDstAU.exe" /sc minute /mo 10 /f
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\mszPG5W.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$task = Get-ScheduledTask -TaskName 'MljJiCHBe';$task.Settings.DisallowStartIfOnBatteries = $false;$task.Settings.StopIfGoingOnBatteri...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "$task = Get-ScheduledTask -TaskName 'MljJiCHBe';$task.Settings.DisallowStartIfOnBatteries = $false;$task.Settings.StopIfGoingOnBatteries = $false;$t...
- '%WINDIR%\syswow64\chcp.com' 65001
- '%WINDIR%\syswow64\reg.exe' query "HKU\S-1-5-19"
- '%WINDIR%\syswow64\reg.exe' add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
- 'C:\oj0fdhb\neljqnkb.exe' ' (with hidden window)
- 'C:\oj0fdhb\jrxs6rac.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /tn "MljJiCHBe" /tr "C:\OJ0fdHb\TSCDstAU.exe" /sc minute /mo 10 /f' (with hidden window)
- '%TEMP%\bd4cae89c3\suker.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$task = Get-ScheduledTask -TaskName 'MljJiCHBe';$task.Settings.DisallowStartIfOnBatteries = $false;$task.Settings.StopIfGoingOnBatteri...' (with hidden window)
