Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft (R) Visual C++ Package Server_BackgroundService' = '"<SYSTEM32>\wscript.exe" /B /nologo "%ALLUSERSPROFILE%\Application Data\Mic...
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Microsoft (R) Visual C++ Package Server_BackgroundService] 'ImagePath' = '"<SYSTEM32>\wscript.exe" /B /nologo "%ALLUSERSPROFILE%\Application Data\Microsoft...
- [<HKLM>\SYSTEM\ControlSet001\Services\Microsoft (R) Visual C++ Package Server_BackgroundService] 'Start' = '00000002'
Malicious functions:
Executes the following:
- '<SYSTEM32>\wscript.exe' /B /nologo "%ALLUSERSPROFILE%\Application Data\Microsoft (R) Visual C++\vcpkgsrv.vbs"
- '%ALLUSERSPROFILE%\Application Data\Microsoft (R) Visual C++\vcpkgsrv.exe'
- '%TEMP%\{52847892-0B30-0B34-A933-EA924383870A}.exe'
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\wscript.exe
Modifies file system:
Creates the following files:
- %ALLUSERSPROFILE%\Application Data\Microsoft (R) Visual C++\MSVCR100.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft (R) Visual C++\MSVCP100.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft (R) Visual C++\vcpkgsrv.blob
- %ALLUSERSPROFILE%\Application Data\Microsoft (R) Visual C++\vcpkgsrv.vbs
- %ALLUSERSPROFILE%\Application Data\Microsoft (R) Visual C++\vcpkgsrv.cab
- %ALLUSERSPROFILE%\Application Data\Microsoft (R) Visual C++\vcpkgsrv.exe
- %TEMP%\{52847892-0B30-0B34-A933-EA924383870A}.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft (R) Visual C++\ATL100.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft (R) Visual C++\cpfe.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft (R) Visual C++\cnbxrf5.dll
Deletes the following files:
- %ALLUSERSPROFILE%\Application Data\Microsoft (R) Visual C++\vcpkgsrv.cab
- %TEMP%\{52847892-0B30-0B34-A933-EA924383870A}.exe
Deletes itself.
Network activity:
Connects to:
- 'cd#.##mesyns.net':9443
- 'ne##.#ataproto.org':3389
- 'st#####.gitrelease.info':443
- 'ne##.#ataproto.org':443
- 'da##.#ranssnic.net':443
- 'st#####.gitrelease.info':9443
- 'cd#.##mesyns.net':3389
- 'da##.#ranssnic.net':9443
- 'ne##.#ataproto.org':9443
- 'cd#.##mesyns.net':443
- 'da##.#ranssnic.net':3389
- 'st#####.gitrelease.info':3389
UDP:
- DNS ASK cd#.##mesyns.net
- DNS ASK st#####.gitrelease.info
- DNS ASK ne##.#ataproto.org
- DNS ASK da##.#ranssnic.net
