Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\1.tmp\bg.exe' print 9f " Task: nslookup"
- '%TEMP%\1.tmp\bg.exe' /pid=2724
- '%TEMP%\1.tmp\bg.exe' /pid=756
- '%TEMP%\1.tmp\bg.exe' /pid=1208
- '%TEMP%\1.tmp\bg.exe' www.google.com 8.8.8.8
- '%TEMP%\1.tmp\bg.exe' /pid=2140
- '%TEMP%\1.tmp\bg.exe' /pid=4000
- '%TEMP%\1.tmp\bg.exe' /pid=2672
- '%TEMP%\1.tmp\bg.exe' firewall show service
- '%TEMP%\1.tmp\bg.exe' /pid=3576
- '%TEMP%\1.tmp\bg.exe' /i "listening"
- '%TEMP%\1.tmp\bg.exe' -an
- '%TEMP%\1.tmp\bg.exe' advfirewall show allprofiles
- '%TEMP%\1.tmp\bg.exe' view
- '%TEMP%\1.tmp\bg.exe' print 9f " Task: net view"
- '%TEMP%\1.tmp\bg.exe' /pid=300
- '%TEMP%\1.tmp\bg.exe' print 9f " Task: WMIC details"
- '%TEMP%\1.tmp\bg.exe' /pid=4608
- '%TEMP%\1.tmp\bg.exe' /pid=3140
- '%TEMP%\1.tmp\bg.exe' print 9f " Task: arp table"
- '%TEMP%\1.tmp\bg.exe' www.google.com 4.2.2.3
- '%TEMP%\1.tmp\bg.exe' /pid=3660
- '%TEMP%\1.tmp\bg.exe' /pid=2176
- '%TEMP%\1.tmp\bg.exe' print 9f " Task: routing table"
- '%TEMP%\1.tmp\bg.exe' print 9f " Task: trace route"
- '%TEMP%\1.tmp\bg.exe' /pid=3740
- '%TEMP%\1.tmp\bg.exe' /pid=3728
- '%TEMP%\1.tmp\bg.exe' print 1f " " 90 " \n"
- '%TEMP%\1.tmp\bg.exe' print 1f " " 90 " " 9f "Information Script" 90 " |___/ " 9f "1.\1" 90 " \n"
- '%TEMP%\1.tmp\bg.exe' print 1f " " 90 " |____/ \\__,_|\\__,_|_|\\___/ \\__, | \n"
- '%TEMP%\1.tmp\bg.exe' locate 12 4
- '%TEMP%\1.tmp\bg.exe' print 90 " "
- '%TEMP%\1.tmp\bg.exe' locate 11 4
- '%TEMP%\1.tmp\bg.exe' print 1f " " 90 " | |_| | |_| | (_| | | (_) | (_| | \n"
- '%TEMP%\1.tmp\bg.exe' locate 1 0
- '%TEMP%\1.tmp\bg.exe' color 1f
- '%TEMP%\1.tmp\bg.exe' cursor 0
- '%TEMP%\1.tmp\bg.exe' print 1f " " 90 " | | | | | | |/ _` | |/ _ \\ / _` | \n"
- '%TEMP%\1.tmp\bg.exe' print 1f " " 90 " | _ \\ _ _ __ _| | ___ __ _ \n"
- '%TEMP%\1.tmp\bg.exe' print 1f " " 90 " ____ _ \n"
- '%TEMP%\1.tmp\bg.exe' print 9f " Task: ipconfig"
- '%TEMP%\1.tmp\bg.exe' color 9f
- '%TEMP%\1.tmp\bg.exe' print ef " "
- '%TEMP%\1.tmp\bg.exe' print 9f " Task: firewall info"
- '%TEMP%\1.tmp\bg.exe' print 9f " Task: service list"
- '%TEMP%\1.tmp\bg.exe' print 9f " Task: system info"
- '%TEMP%\1.tmp\bg.exe' locate 14 7
- '%TEMP%\1.tmp\bg.exe' locate 14 4
- '%TEMP%\1.tmp\bg.exe' locate 13 4
- '%TEMP%\1.tmp\bg.exe' print 9f " Generating report. Please wait.. "
- '%TEMP%\1.tmp\bg.exe' locate 17 4
- '%TEMP%\1.tmp\bg.exe' locate 16 4
- '%TEMP%\1.tmp\bg.exe' locate 15 4
Executes the following:
- '<SYSTEM32>\tracert.exe' -w 800 -d -h 15 8.8.8.8
- '<SYSTEM32>\nslookup.exe' www.google.com
- '<SYSTEM32>\route.exe' print
- '<SYSTEM32>\wbem\wmic.exe' NIC list
- '<SYSTEM32>\arp.exe' -a
- '<SYSTEM32>\sc.exe' /pid=3632
- '<SYSTEM32>\ipconfig.exe' /all
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\generic_dualog_check.bat" <Current directory>\"
- '<SYSTEM32>\systeminfo.exe'
- '<SYSTEM32>\ipconfig.exe' /pid=3380
- '<SYSTEM32>\sc.exe' query state= all
Injects code into
the following system processes:
- <SYSTEM32>\netsh.exe
Modifies file system :
Creates the following files:
- <Current directory>\temp.out
- %TEMP%\tmp2.tmp
- %TEMP%\tmp3.tmp
- <Current directory>\DualogReport_CRNJEUFU.txt
- %TEMP%\1.tmp\generic_dualog_check.bat
- %TEMP%\1.tmp\bg.exe
- %TEMP%\1.tmp\sl.exe
Deletes the following files:
- %TEMP%\tmp2.tmp
Network activity:
Connects to:
- '4.#.2.3':53
- '8.#.8.8':53
- '<Private IP address>':53
