Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Realtek HD Audio Universal Service' = '%APPDATA%\Microsoft\Protect\SecurityHealthSystray.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath %TEMP%\app_1758044462243891500.exe
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM firefox.exe
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\app_1758044462243891500.exe
- nul
- %APPDATA%\microsoft\protect\securityhealthsystray.exe
- %TEMP%\vryxen\socialmedias\socials.zip
Sets the 'hidden' attribute to the following files
- %TEMP%\app_1758044462243891500.exe
- %APPDATA%\microsoft\protect\securityhealthsystray.exe
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\app_1758044462243891500.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq 360chrome.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq 360chrome.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq 360se.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq 360se.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq avant.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq avant.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq brave.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq brave.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq chrome.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq chrome.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq chromium.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq chromium.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq citrio.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq citrio.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq comodo_dragon.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq comodo_dragon.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq coolnovo.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq coolnovo.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq coowon.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq coowon.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq cyberfox.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq cyberfox.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq deepnet.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq deepnet.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq dooble.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq dooble.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq epic.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq epic.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq firefox.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq firefox.exe"
- '<SYSTEM32>\cmd.exe' /C taskkill /F /IM firefox.exe
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq iceweasel.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq iceweasel.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq iridium.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq iridium.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq k-meleon.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq k-meleon.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq maxthon.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq maxthon.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq msedge.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq msedge.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq netscape.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq netscape.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq opera.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq opera.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq palemoon.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq palemoon.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq safari.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq safari.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq seamonkey.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq seamonkey.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq sleipnir.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq sleipnir.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq sputnik.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq sputnik.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq torch.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq torch.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq ucbrowser.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq ucbrowser.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq vivaldi.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq vivaldi.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq waterfox.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq waterfox.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq yandex.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq yandex.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq yandexbrowser.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq yandexbrowser.exe"
- '<SYSTEM32>\cmd.exe' /C tasklist /FI "IMAGENAME eq operagx.exe"
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq operagx.exe"
- '<SYSTEM32>\attrib.exe' +h +s %TEMP%\app_1758044462243891500.exe
- '<SYSTEM32>\reagentc.exe' /disable
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\attrib.exe' +h +s %APPDATA%\Microsoft\Protect\SecurityHealthSystray.exe
- '<SYSTEM32>\attrib.exe' +h +s %TEMP%\app_1758044462243891500.exe' (with hidden window)
- '<SYSTEM32>\tasklist.exe' ' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath %TEMP%\app_1758044462243891500.exe' (with hidden window)
