Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\g1cKmTyJy6_hH2dWcxCW] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\g1cKmTyJy6_hH2dWcxCW] 'ImagePath' = 'cmd /c cd /d "C:\dell\sBat\eDjjTE\0lEOrP\oyLq\" && start "" "C:\dell\sBat\eDjjTE\0lEOrP\oyLq\eZULe3.exe"'
Creates the following services
- 'g1cKmTyJy6_hH2dWcxCW' cmd /c cd /d "C:\dell\sBat\eDjjTE\0lEOrP\oyLq\" && start "" "C:\dell\sBat\eDjjTE\0lEOrP\oyLq\eZULe3.exe"
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'C:\dell\sBat\eDjjTE\0lEOrP\oyLq\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Set-MpPreference -MAPSReporting Disabled"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Set-MpPreference -SubmitSamplesConsent NeverSend"
Modifies file system
Creates the following files
- %TEMP%\is-r0g86.tmp\<File name>.tmp
- %TEMP%\is-eubq9.tmp\_isetup\_setup64.tmp
- C:\dell\sbat\edjjte\0leorp\oylq\is-ianal.tmp
- C:\dell\sbat\edjjte\0leorp\oylq\is-q3e1p.tmp
- C:\dell\sbat\edjjte\0leorp\oylq\is-9ipfj.tmp
Deletes following files that it created itself
- %TEMP%\is-eubq9.tmp\_isetup\_setup64.tmp
- %TEMP%\is-r0g86.tmp\<File name>.tmp
Moves the following files
- from C:\dell\sbat\edjjte\0leorp\oylq\is-ianal.tmp to C:\dell\sbat\edjjte\0leorp\oylq\ezule3.exe
- from C:\dell\sbat\edjjte\0leorp\oylq\is-q3e1p.tmp to C:\dell\sbat\edjjte\0leorp\oylq\f3d2.sf
- from C:\dell\sbat\edjjte\0leorp\oylq\is-9ipfj.tmp to C:\dell\sbat\edjjte\0leorp\oylq\h.k
Network activity
UDP
- DNS ASK fg##j9h.com
Miscellaneous
Creates and executes the following
- '%TEMP%\is-r0g86.tmp\<File name>.tmp' /SL5="$80272,18670902,1152512,<Full path to file>"
- 'C:\dell\sbat\edjjte\0leorp\oylq\ezule3.exe'
Executes the following
- 'C:\dell\sbat\edjjte\0leorp\oylq\ezule3.exe' ' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'C:\dell\sBat\eDjjTE\0lEOrP\oyLq\'"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Set-MpPreference -MAPSReporting Disabled"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Set-MpPreference -SubmitSamplesConsent NeverSend"' (with hidden window)
