Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\llozipdk
- <SYSTEM32>\tasks\ismailnewsdisplay
- <SYSTEM32>\tasks\kvcfvinky
- <SYSTEM32>\tasks\zweefntftmt
- <SYSTEM32>\tasks\tags
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile Add-MpPreference -ExclusionPath %LOCALAPPDATA%,%TEMP%\;Add-MpPreference -ExclusionPath %LOCALAPPDATA%\Count\dyncahdc\IsMailNewsDisplay.exe...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionPath '%APPDATA%\Id\Tags.exe' -Force ; Add-MpPreference -ExclusionPath '%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\' -Force...
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework64\v4.0.30319\msbuild.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_compiler.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
Modifies file system
Creates the following files
- %TEMP%\content\4432-2748-<File name>.exe-06-35-27-720.dump
- %TEMP%\8748c41e28c24f6fa218b8d72792974f.xml
- %LOCALAPPDATA%\count\dyncahdc\ismailnewsdisplay.exe
- %TEMP%\57672cb0b6274f0e984d4e69bb38a6c7.xml
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
- %TEMP%\content\3704-3924-ismailnewsdisplay.exe-06-36-06-112.dump
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\ismailnewsdisplay.exe.log
- %TEMP%\content\824-2408-msbuild.exe-06-36-12-532.dump
- %TEMP%\xibaiw.exe
- %TEMP%\a662ecaa548044cf81121cef162b97e4.xml
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\msbuild.exe.log
- %TEMP%\content\4696-1384-xibaiw.exe-06-36-26-513.dump
- %TEMP%\content\4696-1384-xibaiw.exe-06-36-27-414.dump
- %TEMP%\content\4696-1384-xibaiw.exe-06-36-27-422.dump
- %TEMP%\content\4696-1384-xibaiw.exe-06-36-29-302.dump
- %APPDATA%\id\tags.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\xibaiw.exe.log
- %TEMP%\content\4716-2956-tags.exe-06-36-56-898.dump
- %TEMP%\content\4716-2956-tags.exe-06-36-57-952.dump
- %TEMP%\content\4716-2956-tags.exe-06-36-57-960.dump
- %TEMP%\content\4716-2956-tags.exe-06-37-00-826.dump
Sets the 'hidden' attribute to the following files
- %APPDATA%\id\tags.exe
Deletes following files that it created itself
- %TEMP%\8748c41e28c24f6fa218b8d72792974f.xml
- %TEMP%\57672cb0b6274f0e984d4e69bb38a6c7.xml
- %TEMP%\a662ecaa548044cf81121cef162b97e4.xml
- <SYSTEM32>\tasks\llozipdk
- <SYSTEM32>\tasks\zweefntftmt
- <SYSTEM32>\tasks\kvcfvinky
Network activity
Connects to
- 'wi#####rdr.hopto.org':58007
- 'gi##ub.com':443
- 'ra#.####ubusercontent.com':443
- 'wi#####rdr.hopto.org':58008
TCP
Other
- 'wi#####rdr.hopto.org':58007
- 'gi##ub.com':443
- 'ra#.####ubusercontent.com':443
- 'wi#####rdr.hopto.org':58008
UDP
- DNS ASK wi#####rdr.hopto.org
- DNS ASK gi##ub.com
- DNS ASK ra#.####ubusercontent.com
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\count\dyncahdc\ismailnewsdisplay.exe'
- '%TEMP%\xibaiw.exe'
- '%APPDATA%\id\tags.exe'
Executes the following
- '<SYSTEM32>\schtasks.exe' /Create /TN "llozipdk" /XML "%TEMP%\8748c41e28c24f6fa218b8d72792974f.xml" /F
- '<SYSTEM32>\schtasks.exe' /Create /TN "IsMailNewsDisplay" /XML "%TEMP%\57672cb0b6274f0e984d4e69bb38a6c7.xml" /F
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\msbuild.exe'
- '<SYSTEM32>\schtasks.exe' /Create /TN "kvcfvinky" /XML "%TEMP%\a662ecaa548044cf81121cef162b97e4.xml" /F
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -NoProfile -Command "System.Collections.Generic.List`1[System.String]"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_compiler.exe'
- '<SYSTEM32>\schtasks.exe' /Create /TN "llozipdk" /XML "%TEMP%\8748c41e28c24f6fa218b8d72792974f.xml" /F' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Create /TN "IsMailNewsDisplay" /XML "%TEMP%\57672cb0b6274f0e984d4e69bb38a6c7.xml" /F' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Create /TN "kvcfvinky" /XML "%TEMP%\a662ecaa548044cf81121cef162b97e4.xml" /F' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_compiler.exe' ' (with hidden window)
