Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '532bab156e0b5080bc8bdcbeb5e7557e' = '"%TEMP%\dll.exe" ..'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '532bab156e0b5080bc8bdcbeb5e7557e' = '"%TEMP%\dll.exe" ..'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\532bab156e0b5080bc8bdcbeb5e7557e.exe
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\dll.exe" "dll.exe" ENABLE
Modifies file system
Creates the following files
- %TEMP%\x-raymod.jar
- %TEMP%\launcher.png
- %TEMP%\minecraft.lnk
- %TEMP%\outside.gif
- %TEMP%\launcher.exe
- %TEMP%\dll.exe
- %TEMP%\dll.exe.hash
- %TEMP%\inside.js
Deletes the following files
- %TEMP%\minecraft.lnk
- %TEMP%\outside.js
- %TEMP%\launcher.png
- %TEMP%\inside.js
Moves the following files
- from %TEMP%\outside.gif to %TEMP%\outside.js
Network activity
Connects to
- 'localhost':80
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\outside.js"
- '%TEMP%\launcher.exe' -pdasha -d%LOCALAPPDATA%\Temp
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\inside.js"
- '%TEMP%\dll.exe' -d%LOCALAPPDATA%\Temp
- '%TEMP%\launcher.exe' -pdasha -d%LOCALAPPDATA%\Temp' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del %TEMP%\X-RAYMOD.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del %TEMP%\Minecraft.lnk' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del %TEMP%\outside.js' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del %TEMP%\Launcher.png' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del %TEMP%\Launchers.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del %TEMP%\inside.js' (with hidden window)
- '%TEMP%\dll.exe' -d%LOCALAPPDATA%\Temp' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\dll.exe" "dll.exe" ENABLE' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c rename %TEMP%\outside.gif outside.js
- '%ProgramFiles%\java\jre1.8.0_45\bin\javaw.exe' -jar "%TEMP%\X-RAYMOD.jar" -d%LOCALAPPDATA%\Temp
- '%WINDIR%\syswow64\cmd.exe' /c del %TEMP%\X-RAYMOD.exe
- '%WINDIR%\syswow64\cmd.exe' /c del %TEMP%\Minecraft.lnk
- '%WINDIR%\syswow64\cmd.exe' /c del %TEMP%\outside.js
- '%WINDIR%\syswow64\cmd.exe' /c del %TEMP%\Launcher.png
- '%WINDIR%\syswow64\cmd.exe' /c del %TEMP%\Launchers.exe
- '%WINDIR%\syswow64\cmd.exe' /c del %TEMP%\inside.js
