Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\software\Microsoft\Windows\CurrentVersion\Run] '29d878c7609e76d86d6f4e706a23eeca' = '"%TEMP%\server.exe" ..'
- [<HKLM>\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '29d878c7609e76d86d6f4e706a23eeca' = '"%TEMP%\server.exe" ..'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\29d878c7609e76d86d6f4e706a23eeca.exe
Creates the following files on removable media
- <Drive name for removable media>:\29d878c7609e76d86d6f4e706a23eeca.exe
- <Drive name for removable media>:\autorun.inf
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Modifies file system
Creates the following files
- <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\xsandbox.bin.__tmp__
- %TEMP%\rarsfx0\dnsjumper.ini
- %TEMP%\jwopxzp
- %TEMP%\aut41ae.tmp
- <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0x794d1e811ce35157\dnsjumper.exe.manifest.__tmp__
- <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0x794d1e811ce35157\dnsjumper.exe.__tmp__
- <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xdbc34ed6ea59554b\server.exe.manifest.__tmp__
- <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xdbc34ed6ea59554b\server.exe.__tmp__
- %TEMP%\server.exe
- <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xdbc34ed6ea59554b\dnsjumper1.exe.manifest.__tmp__
- <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xdbc34ed6ea59554b\dnsjumper1.exe.__tmp__
- %TEMP%\rarsfx0\dnsjumper1.exe
- %TEMP%\rarsfx0\dnsjumper.exe
- <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0x8378e45f14139612\dnsjumper.exe.manifest.__tmp__
- <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0x8378e45f14139612\dnsjumper.exe.__tmp__
- %TEMP%\spoon\cache\0x04cb1aa5d620673d\sxs\x86_winrar sfx@1.0.0.0\x86_winrar sfx@1.0.0.0.manifest.__tmp__
- %TEMP%\spoon\cache\0x04cb1aa5d620673d\sxs\x86_winrar sfx@1.0.0.0\winrar sfx.manifest.__tmp__
- %TEMP%\spoon\cache\0x04cb1aa5d620673d\sxs\manifests\dnsjumper.exe_0xd117a50869daa2c31c28911142063d7c.1.manifest.__tmp__
- <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xfee3e7d42c6d9c15\netsh.exe.__tmp__
- <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xfee3e7d42c6d9c15\netsh.exe.manifest.__tmp__
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\29d878c7609e76d86d6f4e706a23eeca.exe
- <Drive name for removable media>:\autorun.inf
- %TEMP%\server.exe
- %APPDATA%\microsoft\windows\start menu\programs\startup\29d878c7609e76d86d6f4e706a23eeca.exe
Deletes the following files
- %TEMP%\aut41ae.tmp
- %TEMP%\jwopxzp
Moves the following files
- from <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\xsandbox.bin.__tmp__ to <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\xsandbox.bin
- from %TEMP%\spoon\cache\0x04cb1aa5d620673d\sxs\manifests\dnsjumper.exe_0xd117a50869daa2c31c28911142063d7c.1.manifest.__tmp__ to %TEMP%\spoon\cache\0x04cb1aa5d620673d\sxs\manifests\dnsjumper.exe_0xd117a50869daa2c31c28911142063d7c.1.manifest
- from %TEMP%\spoon\cache\0x04cb1aa5d620673d\sxs\x86_winrar sfx@1.0.0.0\winrar sfx.manifest.__tmp__ to %TEMP%\spoon\cache\0x04cb1aa5d620673d\sxs\x86_winrar sfx@1.0.0.0\winrar sfx.manifest
- from %TEMP%\spoon\cache\0x04cb1aa5d620673d\sxs\x86_winrar sfx@1.0.0.0\x86_winrar sfx@1.0.0.0.manifest.__tmp__ to %TEMP%\spoon\cache\0x04cb1aa5d620673d\sxs\x86_winrar sfx@1.0.0.0\x86_winrar sfx@1.0.0.0.manifest
- from <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0x8378e45f14139612\dnsjumper.exe.__tmp__ to <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0x8378e45f14139612\dnsjumper.exe
- from <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0x8378e45f14139612\dnsjumper.exe.manifest.__tmp__ to <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0x8378e45f14139612\dnsjumper.exe.manifest
- from <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xdbc34ed6ea59554b\dnsjumper1.exe.__tmp__ to <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xdbc34ed6ea59554b\dnsjumper1.exe
- from <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xdbc34ed6ea59554b\dnsjumper1.exe.manifest.__tmp__ to <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xdbc34ed6ea59554b\dnsjumper1.exe.manifest
- from <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xdbc34ed6ea59554b\server.exe.__tmp__ to <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xdbc34ed6ea59554b\server.exe
- from <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xdbc34ed6ea59554b\server.exe.manifest.__tmp__ to <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xdbc34ed6ea59554b\server.exe.manifest
- from <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0x794d1e811ce35157\dnsjumper.exe.__tmp__ to <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0x794d1e811ce35157\dnsjumper.exe
- from <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0x794d1e811ce35157\dnsjumper.exe.manifest.__tmp__ to <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0x794d1e811ce35157\dnsjumper.exe.manifest
- from <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xfee3e7d42c6d9c15\netsh.exe.__tmp__ to <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xfee3e7d42c6d9c15\netsh.exe
- from <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xfee3e7d42c6d9c15\netsh.exe.manifest.__tmp__ to <LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xfee3e7d42c6d9c15\netsh.exe.manifest
Network activity
Connects to
- 'em######aily.publicvm.com':11001
UDP
- DNS ASK em######aily.publicvm.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '<LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0x8378e45f14139612\dnsjumper.exe' /864A627C-C6B2-464A-AA13-25D62F282BD8
- '<LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xdbc34ed6ea59554b\dnsjumper1.exe' /864A627C-C6B2-464A-AA13-25D62F282BD8
- '<LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xdbc34ed6ea59554b\server.exe' /864A627C-C6B2-464A-AA13-25D62F282BD8
- '<LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0x794d1e811ce35157\dnsjumper.exe' /864A627C-C6B2-464A-AA13-25D62F282BD8
- '<LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xfee3e7d42c6d9c15\netsh.exe' /864A627C-C6B2-464A-AA13-25D62F282BD8
- '<LS_APPDATA>\turbo.net\sandbox\1.0.0.0\local\stubexe\0xfee3e7d42c6d9c15\netsh.exe' /864A627C-C6B2-464A-AA13-25D62F282BD8' (with hidden window)
