Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\timer
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath %WINDIR%\
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath \\?\%WINDIR% \
Modifies file system
Creates the following files
- %WINDIR%\system\svchost.exe
- %LOCALAPPDATA%\torproject\arti\cache\dir.sqlite3-journal
- %LOCALAPPDATA%\torproject\arti\cache\dir.sqlite3
- %LOCALAPPDATA%\torproject\arti\data\state\circuit_timeouts.tmp
- %LOCALAPPDATA%\torproject\arti\data\state\guards.tmp
- %LOCALAPPDATA%\torproject\arti\cache\dir_blobs\con_microdesc_sha3-256-37736f022e148ad10e1bd9c9b218f8af46b004b862b55d4b6f6dfd8a6b175868.tmp
Deletes the following files
- %LOCALAPPDATA%\torproject\arti\cache\dir.sqlite3-journal
Moves the following files
- from %LOCALAPPDATA%\torproject\arti\data\state\circuit_timeouts.tmp to %LOCALAPPDATA%\torproject\arti\data\state\circuit_timeouts.json
- from %LOCALAPPDATA%\torproject\arti\data\state\guards.tmp to %LOCALAPPDATA%\torproject\arti\data\state\guards.json
- from %LOCALAPPDATA%\torproject\arti\cache\dir_blobs\con_microdesc_sha3-256-37736f022e148ad10e1bd9c9b218f8af46b004b862b55d4b6f6dfd8a6b175868.tmp to %LOCALAPPDATA%\torproject\arti\cache\dir_blobs\con_microdesc_sha3-256-37736f022e148ad10e1bd9c9b218f8af46b004b862b55d4b6f6dfd8a6b175868
Substitutes the following files
- %LOCALAPPDATA%\torproject\arti\data\state\circuit_timeouts.tmp
- %LOCALAPPDATA%\torproject\arti\data\state\guards.tmp
- %LOCALAPPDATA%\torproject\arti\cache\dir.sqlite3-journal
- %LOCALAPPDATA%\torproject\arti\data\state\circuit_timeouts.json
- %LOCALAPPDATA%\torproject\arti\data\state\guards.json
Network activity
Connects to
- '45.##.13.158':80
- '18#.#00.85.132':443
- '82.##7.215.30':9001
- '45.##1.215.235':9100
- 'localhost':9050
- '80.##.172.162':19001
- '13#.#43.60.188':9001
- '15#.#20.100.158':443
- '16#.#55.84.47':443
- '17#.#6.137.143':9000
- '88.##.145.25':9993
- '46.#.78.3':4443
- '15#.#0.92.115':9001
TCP
HTTP GET requests
- http://45.##.13.158/?a=############################################################
Other
- '18#.#00.85.132':443
- '45.##1.215.235':9100
- 'localhost':9050
- 'localhost':49187
- '80.##.172.162':19001
- '13#.#43.60.188':9001
- '15#.#20.100.158':443
- '17#.#6.137.143':9000
- '16#.#55.84.47':443
- '88.##.145.25':9993
- '46.#.78.3':4443
- '15#.#0.92.115':9001
Miscellaneous
Creates and executes the following
- '%WINDIR%\system\svchost.exe' formal
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath %WINDIR%\' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath \\?\%WINDIR% \' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /delete /TN "Timer"' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr %WINDIR%\system\svchost.exe /ru SYSTEM' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /delete /TN "Timer"
- '<SYSTEM32>\schtasks.exe' /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr %WINDIR%\system\svchost.exe /ru SYSTEM
