Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="VSMRepo Service" action=allow protocol=TCP dir=in
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="VSMRepo Service" action=allow protocol=TCP dir=out
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram c:\ourofarma\VSMDownloader.exe VSMDownloader ENABLE
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram c:\ourofarma\VSMRepo.exe VSMRepo ENABLE
Modifies file system
Creates the following files
- <Current directory>\logs\<File name>-2020-07-31.txt
- <Current directory>\firewall.ini
Deletes the following files
- <Current directory>\firewall.ini
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall show rule name="VSMRepo Service" > <Current directory>\FIREWALL.ini' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall delete rule name="VSM HTTP Service"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall delete rule name="HTTP Service"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall delete rule name="Servidor de Distribuição de Atualizações"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall delete rule name="VSMRepo Service"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall delete rule name="VSMRepo"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall delete rule name="VSMDownloader"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall add rule name="VSMRepo Service" action=allow protocol=TCP dir=in' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall add rule name="VSMRepo Service" action=allow protocol=TCP dir=out' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall set global StatefulFTP disable' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C netsh firewall add allowedprogram c:\ourofarma\VSMDownloader.exe VSMDownloader ENABLE' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C netsh firewall add allowedprogram c:\ourofarma\VSMRepo.exe VSMRepo ENABLE' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall show rule name="VSMRepo Service" > <Current directory>\FIREWALL.ini
- '%WINDIR%\syswow64\netsh.exe' advfirewall set global StatefulFTP disable
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall set global StatefulFTP disable
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall add rule name="VSMRepo Service" action=allow protocol=TCP dir=out
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall add rule name="VSMRepo Service" action=allow protocol=TCP dir=in
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="VSMDownloader"
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall delete rule name="VSMDownloader"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="VSMRepo"
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall delete rule name="VSMRepo"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="VSMRepo Service"
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall delete rule name="VSMRepo Service"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="Servidor de Distribuição de Atualizações"
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall delete rule name="Servidor de Distribuição de Atualizações"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="HTTP Service"
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall delete rule name="HTTP Service"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="VSM HTTP Service"
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall delete rule name="VSM HTTP Service"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall show rule name="VSMRepo Service"
- '%WINDIR%\syswow64\cmd.exe' /C netsh firewall add allowedprogram c:\ourofarma\VSMDownloader.exe VSMDownloader ENABLE
- '%WINDIR%\syswow64\cmd.exe' /C netsh firewall add allowedprogram c:\ourofarma\VSMRepo.exe VSMRepo ENABLE
