Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'syshost32' = '%WINDIR%\Installer\{4D4286D0-B027-0FBF-DACC-EB359300F4DA}\syshost.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\syshost32] 'ImagePath' = '"%WINDIR%\Installer\{4D4286D0-B027-0FBF-DACC-EB359300F4DA}\syshost.exe" /service'
- [<HKLM>\SYSTEM\ControlSet001\Services\syshost32] 'Start' = '00000002'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DoNotAllowExceptions' = '00000000'
Creates and executes the following:
- '%WINDIR%\Installer\{4D4286D0-B027-0FBF-DACC-EB359300F4DA}\syshost.exe'
Executes the following:
- '%WINDIR%\Installer\{4D4286D0-B027-0FBF-DACC-EB359300F4DA}\syshost.exe'
- '<SYSTEM32>\netsh.exe' firewall set opmode mode=DISABLE profile=ALL
- '%WINDIR%\Installer\{4D4286D0-B027-0FBF-DACC-EB359300F4DA}\syshost.exe' /service
- '<SYSTEM32>\cmd.exe' /C del /Q /F "%TEMP%\dbc596a4.tmp"
Injects code into
the following user processes:
- syshost.exe
Modifies file system:
Creates the following files:
- %TEMP%\e6afe82f-3b6a-f9d4-ea5b-ff081176a70b.tmp
- %WINDIR%\Installer\{4D4286D0-B027-0FBF-DACC-EB359300F4DA}\syshost.exe
Moves itself:
- from <Full path to file> to %TEMP%\dbc596a4.tmp
Deletes itself.
Network activity:
Connects to:
- '21#.#9.27.241':80
- '2.###l.ntp.org':123
- '19#.#54.217.232':6641
- '18#.#9.171.254':13673
- '18#.#15.66.185':11319
- '20#.#6.232.182':80
- '1.###l.ntp.org':123
- '0.###l.ntp.org':123
UDP:
- DNS ASK qc###rtuop.bit
- DNS ASK 0.###l.ntp.org
- DNS ASK 2.###l.ntp.org
- DNS ASK 1.###l.ntp.org
- DNS ASK ux####abheobgbz.com
- DNS ASK wh###vwnax.com
- DNS ASK sm####ypfqalqn.com
- DNS ASK microsoft.com
- DNS ASK ug####glkrwq.com
- '20#.#3.154.102':7606
- '18#.#15.15.67':15954
- '27.##.17.255':20806
- 'localhost':1053
- 'localhost':1056
- '21#.#03.21.137':24533
- '22#.#0.224.172':28506
- 'localhost':1054
- '22#.#0.97.44':17943
- '17#.#39.91.163':32181
- '89.##5.180.19':24216
- '11#.#71.109.137':6635
- 'localhost':1044
- '14#.#13.79.71':5522
- 'localhost':1046
- '20#.#00.160.177':20393
- 'localhost':1045
