Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SEJOKAOI5S' = '"%APPDATA%\sZEgdMSmYZ.js"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'wcebudiv' = '"%APPDATA%\wcebudiv.txt"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'wcebudiv' = '"%APPDATA%\wcebudiv.txt"'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\szegdmsmyz.js
- %APPDATA%\microsoft\windows\start menu\programs\startup\wcebudiv.txt
- <SYSTEM32>\tasks\skype
Modifies file system
Creates the following files
- %APPDATA%\szegdmsmyz.js
- %APPDATA%\wcebudiv.txt
- %HOMEPATH%\lib\jna-5.5.0.jard
- %HOMEPATH%\lib\jna-platform-5.5.0.jard
- %HOMEPATH%\lib\sqlite-jdbc-3.14.2.1.jard
- %HOMEPATH%\lib\system-hook-3.5.jard
- %HOMEPATH%\wcebudiv.txt
- %TEMP%\jna-3599307\jna7300851752077393052.dll
- %APPDATA%\lib\jna-5.5.0.jar
- %APPDATA%\lib\jna-platform-5.5.0.jar
- %APPDATA%\lib\sqlite-jdbc-3.14.2.1.jar
- %APPDATA%\lib\system-hook-3.5.jar
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\wcebudiv.txt
- %TEMP%\jna-3599307\jna1154374662874523524.dll
Deletes the following files
- %TEMP%\jna-3599307\jna7300851752077393052.dll
- %TEMP%\jna-3599307\jna1154374662874523524.dll
Moves the following files
- from %HOMEPATH%\lib\system-hook-3.5.jard to %HOMEPATH%\lib\system-hook-3.5.jar
- from %HOMEPATH%\lib\jna-5.5.0.jard to %HOMEPATH%\lib\jna-5.5.0.jar
- from %HOMEPATH%\lib\jna-platform-5.5.0.jard to %HOMEPATH%\lib\jna-platform-5.5.0.jar
- from %HOMEPATH%\lib\sqlite-jdbc-3.14.2.1.jard to %HOMEPATH%\lib\sqlite-jdbc-3.14.2.1.jar
Network activity
Connects to
- 'ga#####ver-789.duia.ro':6789
TCP
HTTP GET requests
- http://ip##pi.com/json/
Other
- 're###.maven.org':443
- 'gi##ub.com':443
- 'gi#########ases.githubusercontent.com':443
- '45.##4.225.159':3035
UDP
- DNS ASK ga#####ver-789.duia.ro
- DNS ASK re###.maven.org
- DNS ASK gi##ub.com
- DNS ASK gi#########ases.githubusercontent.com
- DNS ASK st###aster.pw
- DNS ASK ja###2.ddns.net
- DNS ASK ip##pi.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "%APPDATA%\sZEgdMSmYZ.js"
Executes the following
- '%ProgramFiles%\java\jre1.8.0_45\bin\javaw.exe' -jar "%APPDATA%\wcebudiv.txt"
- '%ProgramFiles%\java\jre1.8.0_45\bin\java.exe' -jar "%HOMEPATH%\wcebudiv.txt"
- '<SYSTEM32>\cmd.exe' /c schtasks /create /sc minute /mo 30 /tn Skype /tr "%APPDATA%\wcebudiv.txt"
- '%ProgramFiles%\java\jre1.8.0_45\bin\java.exe' -jar "%APPDATA%\wcebudiv.txt"
- '<SYSTEM32>\schtasks.exe' /create /sc minute /mo 30 /tn Skype /tr "%APPDATA%\wcebudiv.txt"
- '<SYSTEM32>\cmd.exe' /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"
- '<SYSTEM32>\wbem\wmic.exe' /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list
- '<SYSTEM32>\cmd.exe' /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"
- '<SYSTEM32>\wbem\wmic.exe' /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list
- '<SYSTEM32>\cmd.exe' /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"
- '<SYSTEM32>\wbem\wmic.exe' /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list
- '<SYSTEM32>\cmd.exe' /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list"
- '<SYSTEM32>\wbem\wmic.exe' /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list
