Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\syshost32] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\syshost32] 'ImagePath' = '"%WINDIR%\Installer\{DF5B18FA-CA93-5F15-3F96-D5701F8548AA}\syshost.exe" /service'
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall set rule name="Core Networking - System IP Core" dir=in new action=allow enable=yes profile=any
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Core Networking - System IP Core" dir=in action=allow enable=yes profile=any
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall set rule name="Core Networking - System IP Core" dir=out new action=allow enable=yes profile=any
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Core Networking - System IP Core" dir=out action=allow enable=yes profile=any
Modifies file system
Creates the following files
- %WINDIR%\installer\{df5b18fa-ca93-5f15-3f96-d5701f8548aa}\syshost.exe
- %WINDIR%\temp\ed0c884a-6dfe-eb23-8182-feeff5418f57.tmp
Moves itself
- from <Full path to file> to %TEMP%\8b96a244.tmp
Deletes itself.
Network activity
Connects to
- 'microsoft.com':80
- '94.##7.155.117':24223
- '79.##.106.235':27505
- '17#.#8.208.65':30773
- '20#.#38.242.185':19247
- '5.###.188.33':4719
- '1.###.149.106':28843
- '85.##0.172.175':29095
UDP
- DNS ASK microsoft.com
- DNS ASK vk###lruzgn.com
- DNS ASK sv###hedmxg.com
- DNS ASK iu####zlccqi.com
- DNS ASK fd####tykzkf.com
- DNS ASK 0.###l.ntp.org
- DNS ASK 1.###l.ntp.org
- DNS ASK 2.###l.ntp.org
- '58.##0.167.111':25243
- '84.##7.185.187':20336
- '1.###.104.165':27106
- '20#.#4.54.240':13953
- '1.##.213.182':23143
- '89.##6.85.31':17494
- '18#.#18.174.240':11981
- '49.#07.23.1':10335
- '95.##4.38.161':31136
- '18#.#.230.252':17531
- '60.##1.49.107':13710
- '20#.#03.16.50':24073
- '18#.#9.101.145':26422
- '18#.#5.149.94':15165
- '19#.#9.197.24':13341
- '1.###l.ntp.org':123
- '18#.#8.202.153':20768
- '0.###l.ntp.org':123
- '11#.#84.234.72':28495
- '2.###l.ntp.org':123
- '11#.#96.132.29':25705
- '19#.#8.73.17':6255
- '17#.#57.32.75':28654
- '21#.#10.114.13':17837
- '94.##7.181.155':32475
- '10#.#22.83.44':28516
- '19#.#08.15.190':19399
- '21#.#33.181.158':18356
- '86.##0.151.179':15367
- '12#.#9.100.133':17181
- '20#.#48.99.55':9470
- '89.##.247.21':7238
Miscellaneous
Creates and executes the following
- '%WINDIR%\installer\{df5b18fa-ca93-5f15-3f96-d5701f8548aa}\syshost.exe' /service
- '%WINDIR%\syswow64\cmd.exe' /C del /Q /F "%TEMP%\8b96a244.tmp"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall set rule name="Core Networking - System IP Core" dir=in new action=allow enable=yes profile=any' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Core Networking - System IP Core" dir=in action=allow enable=yes profile=any' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall set rule name="Core Networking - System IP Core" dir=out new action=allow enable=yes profile=any' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Core Networking - System IP Core" dir=out action=allow enable=yes profile=any' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C del /Q /F "%TEMP%\8b96a244.tmp"
