Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\shellhost
- <SYSTEM32>\tasks\cookiemanager
Creates the following files on removable media
- <Drive name for removable media>:\$recycler\search.exe
- <Drive name for removable media>:\documents.lnk
- <Drive name for removable media>:\photos.lnk
- <Drive name for removable media>:\backup.lnk
Malicious functions
Patches code
in AMSI dll
- gylzqshv.exe process, Amsi.dll module
- search.exe process, Amsi.dll module
in NTDLL dll
- gylzqshv.exe process, ntdll.dll module
- search.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %ProgramFiles%\search.exe
- %LOCALAPPDATA%\searcher.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
- C:\$recycler\search.exe
- C:\$recycle.bin.lnk
- <Current directory>.lnk
- C:\documents and settings.lnk
- C:\kms.lnk
- C:\msocache.lnk
- C:\perflogs.lnk
- C:\program files.lnk
- C:\program files (x86).lnk
- %ALLUSERSPROFILE%.lnk
- C:\recovery.lnk
- C:\users.lnk
- %WINDIR%.lnk
- C:\documents.lnk
- C:\photos.lnk
- C:\backup.lnk
- D:\$recycler\search.exe
- D:\$recycle.bin.lnk
- D:\documents.lnk
- D:\photos.lnk
- D:\backup.lnk
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\search.exe.log
Sets the 'hidden' attribute to the following files
- %ProgramFiles%\search.exe
- %LOCALAPPDATA%\searcher.exe
- C:\$recycler\search.exe
- D:\$recycler\search.exe
- <Drive name for removable media>:\$recycler\search.exe
Network activity
Connects to
- 'ap#.#pify.org':443
- 'ic###azip.com':443
- '18#.#9.97.203':9000
TCP
Other
- 'ap#.#pify.org':443
- 'ic###azip.com':443
UDP
- DNS ASK ap#.#pify.org
- DNS ASK ic###azip.com
Miscellaneous
Creates and executes the following
- '%ProgramFiles%\search.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' 471|cbPaFRkWCNN5FcQyfEtzudLiPoZhDr6MtUYcs6HzhD/5uqMQaLWTp5v14bLu57umWindowsControl472|DbQv0UEHcAZ/oFAhskQAulMyYllmMpaR8Iv8aR6+OqM=%ProgramFiles%\Search.exe" enable=yes & exit
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "%ProgramFiles%\Search.exe" /RL HIGHEST & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /mo 1 /tn "ShellHost" /tr "%ProgramFiles%\Search.exe" /RL HIGHEST
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "%LOCALAPPDATA%\Searcher.exe" /RL HIGHEST & exit
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /mo 30 /tn "CookieManager" /tr "%LOCALAPPDATA%\Searcher.exe" /RL HIGHEST
