Technical Information
Malicious functions
Downloads and executes files.
Modifies file system
Creates the following files
- %WINDIR%\syswow64\windowspowershell\v1.0\efsane.bat
- %WINDIR%\syswow64\windowspowershell\v1.0\kedi.jpeg
- nul
- %TEMP%\~ptr_b.tmp
- %TEMP%\~ptr_b.bat
- %WINDIR%\temp\client.exe
Network activity
Connects to
- 'gi##ub.com':443
- 'ra#.####ubusercontent.com':443
- 'localhost':9875
- '31.##.187.119':9875
TCP
Other
- 'gi##ub.com':443
- 'ra#.####ubusercontent.com':443
- '31.##.187.119':9875
UDP
- DNS ASK gi##ub.com
- DNS ASK ra#.####ubusercontent.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'NarratorUIClass' WindowName: ''
Creates and executes the following
- '%WINDIR%\temp\client.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""<SYSTEM32>\WindowsPowerShell\v1.0\Efsane.bat" "
- '<SYSTEM32>\svchost.exe' -k appmodel -p -s camsvc
- '%WINDIR%\syswow64\chcp.com' 65001
- '%WINDIR%\syswow64\timeout.exe' /t 0
- '%WINDIR%\syswow64\cmd.exe' /c exit 0
- '%WINDIR%\syswow64\certutil.exe' -decode "%TEMP%\~ptr_b.tmp" "%TEMP%\~ptr_b.bat"
- '%WINDIR%\temp\client.exe' ' (with hidden window)
