Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\sfgyjfbgyb.url
Modifies file system
Creates the following files
- %TEMP%\tmp6b4f.tmp.exe
- %APPDATA%\ythtnrgqvj\sfgyjfbgyb.com
- %APPDATA%\ythtnrgqvj\ibbwxq
- %TEMP%\tmp819f.tmp.msi
- %APPDATA%\lglzyeknzulyyut\y
- %APPDATA%\xmzbaspvsnxmdb\sapra.com
- %APPDATA%\lglzyeknzulyyut\busto.exe.com
- %APPDATA%\lglzyeknzulyyut\sfaldavano.wp5
- %APPDATA%\lglzyeknzulyyut\quale.ini
- %APPDATA%\lglzyeknzulyyut\per.psd
- %APPDATA%\xmzbaspvsnxmdb\temi.tiff
- %APPDATA%\xmzbaspvsnxmdb\spinto.xlam
- %APPDATA%\lglzyeknzulyyut\imperiosa.xll
- %APPDATA%\xmzbaspvsnxmdb\poi.pdf
- %APPDATA%\xmzbaspvsnxmdb\mattini.wbk
- %APPDATA%\xmzbaspvsnxmdb\esistenza.xltx
- %APPDATA%\lglzyeknzulyyut\chiamasti.doc
- %TEMP%\tmp6b70.tmp.exe
- %APPDATA%\ythtnrgqvj\esistenza.xltx
- %APPDATA%\ythtnrgqvj\hgyeo.js
Deletes the following files
- %APPDATA%\lglzyeknzulyyut\y
- %APPDATA%\lglzyeknzulyyut\quale.ini
- %APPDATA%\xmzbaspvsnxmdb\spinto.xlam
- %APPDATA%\xmzbaspvsnxmdb\esistenza.xltx
Network activity
Connects to
- 'ho###hner.at':80
- 'wi##mr.club':443
TCP
- 'wi##mr.club':443
UDP
- DNS ASK ho###hner.at
- DNS ASK wi##mr.club
- DNS ASK hh###########ZYoOtpryMy.hhnlUmHdzjZFqZYoOtpryMy
- DNS ASK SI###########ATdRMKmtDh.SIdMEVQqwdvxCATdRMKmtDh
Miscellaneous
Creates and executes the following
- '%TEMP%\tmp6b4f.tmp.exe'
- '%TEMP%\tmp6b70.tmp.exe'
- '%APPDATA%\lglzyeknzulyyut\busto.exe.com' y
- '%APPDATA%\xmzbaspvsnxmdb\sapra.com' Spinto.xlam
- '%WINDIR%\syswow64\cmd.exe' /c echo xUADFFdH' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo wwaILKQR' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\cmd.exe < Sfaldavano.wp5' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\cmd.exe < Poi.pdf' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c echo xUADFFdH
- '%WINDIR%\syswow64\cmd.exe' /c echo wwaILKQR
- '%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\cmd.exe < Sfaldavano.wp5
- '%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\cmd.exe < Poi.pdf
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\findstr.exe' /V /R "^hVIWwcWwnuNOMUkahbdfVWyLXSWGELaErLDkwfNOiCGsyxtqRqfbuepdPXZonfbMNpKwsZsYKBiafOGCOVPEvV$" Per.psd
- '%WINDIR%\syswow64\findstr.exe' /V /R "^wSZJdQSZwKBWJCtpbfZHNwzsXALugVPsbikcLGmlTQMSJGkUUtRoHQkZmHLQyLLuVpnCdInRQPNWfBIsgQkprGKGWkWrUJtiyFXmiJDkGqaSrgKXZxBgABegmSFyMxWuKGRJDopFhZDrhRDHAYtA$" Mattini.wbk
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 30
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\tmp819F.tmp.msi"
