Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'My Program' = '\<Full path to file>\'
Modifies file system
Creates the following files
- C:\users\public\agentnominatus.exe
- C:\users\public\l.txt
- C:\users\public\test.jpg
- C:\users\public\loggprc.txt
- %TEMP%\mci637.tmp
- C:\users\public\loggr.wav
- C:\users\public\ll.exe
- %TEMP%\mci8d23.tmp
Deletes the following files
- %TEMP%\mci637.tmp
- %TEMP%\mci8d23.tmp
Network activity
Connects to
- 'ft###load.net':21
- 'ft###load.net':27233
- 'ft###load.net':38506
- 'ft###load.net':41655
- 'ft###load.net':19816
- 'ft###load.net':56369
- 'ft###load.net':41747
- 'ft###load.net':39571
- 'ft###load.net':18244
- 'ft###load.net':43396
- 'ft###load.net':43851
TCP
Other
- 'ft###load.net':21
- 'ft###load.net':27233
- 'ft###load.net':38506
- 'ft###load.net':41655
- 'ft###load.net':19816
- 'ft###load.net':41747
- 'ft###load.net':39571
- 'ft###load.net':18244
- 'ft###load.net':43396
UDP
- DNS ASK ft###load.net
Miscellaneous
Creates and executes the following
- 'C:\users\public\agentnominatus.exe'
- '%WINDIR%\syswow64\cmd.exe' /C copy nul C:\users\public\AgentNomnatus.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C if exist C:\users\public\AgentNominatus.exe start C:\users\public\AgentNominatus.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo Idle >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo lsass >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo System >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo dwm >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo lsm >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo mdm >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo spoolsv >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo firefox >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo taskhost >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo WUDFHost >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo cmd >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo audiodg >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo winlogon >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo smss >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo csrss >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo <File name> >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo wininit >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo WmiPrvSE >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo iexplore >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo services >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo svchost >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C ipconfig >>C:\users\public\l.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C User: %username% >>C:\users\public\l.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C systeminfo >C:\users\public\l.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo explorer >>C:\users\public\loggPRC.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C echo conhost >>C:\users\public\loggPRC.txt' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C copy nul C:\users\public\AgentNomnatus.exe
- '%WINDIR%\syswow64\cmd.exe' /C if exist C:\users\public\AgentNominatus.exe start C:\users\public\AgentNominatus.exe
- '%WINDIR%\syswow64\cmd.exe' /C echo Idle >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo lsass >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo System >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo dwm >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo lsm >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo mdm >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo spoolsv >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo firefox >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo taskhost >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo WUDFHost >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo audiodg >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo explorer >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo winlogon >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo smss >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo csrss >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo <File name> >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo wininit >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo WmiPrvSE >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo iexplore >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo services >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo svchost >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\ipconfig.exe'
- '%WINDIR%\syswow64\cmd.exe' /C ipconfig >>C:\users\public\l.txt
- '%WINDIR%\syswow64\cmd.exe' /C User: %username% >>C:\users\public\l.txt
- '%WINDIR%\syswow64\systeminfo.exe'
- '%WINDIR%\syswow64\cmd.exe' /C systeminfo >C:\users\public\l.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo cmd >>C:\users\public\loggPRC.txt
- '%WINDIR%\syswow64\cmd.exe' /C echo conhost >>C:\users\public\loggPRC.txt