Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Host' = '%ALLUSERSPROFILE%\Windows Host\Windows Host.exe'
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\813599.exe
- %ALLUSERSPROFILE%\52\b73ea6be64acc1cae356f349fe2916ed.txt
- %ALLUSERSPROFILE%\52\5ad2c283c7a79b5f3b578b28c73d75c6.txt
- %ALLUSERSPROFILE%\52\7113ecffd557a1a61b6f73705234230c.txt
- %ALLUSERSPROFILE%\52\a4af8b70a42b31f1a17d5444297cbec0.txt
- %ALLUSERSPROFILE%\windows host\windows host.exe
- %ALLUSERSPROFILE%\998385.bat
- %ALLUSERSPROFILE%\998385.exe
- %ALLUSERSPROFILE%\52\nss3.dll
- %ALLUSERSPROFILE%\52\msvcp140.dll
- %ALLUSERSPROFILE%\52\mozglue.dll
- %ALLUSERSPROFILE%\52\freebl3.dll
- %ALLUSERSPROFILE%\52\vcruntime140.dll
- %ALLUSERSPROFILE%\52\sqlite3.dll
- %ALLUSERSPROFILE%\52\softokn3.dll
- %ALLUSERSPROFILE%\5258
- %TEMP%\runtime.msil.1.0.0.0\nativepro.dll
- %ALLUSERSPROFILE%\649979.bat
- %ALLUSERSPROFILE%\52\6b7d239558a2b66f533a1c8bf2106093.txt
- %ALLUSERSPROFILE%\52\f8315d49ae3a2ef54877bf97e8765bdb.txt
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\windows host\windows host.exe
Deletes the following files
- %ALLUSERSPROFILE%\52\5ad2c283c7a79b5f3b578b28c73d75c6.txt
- %ALLUSERSPROFILE%\52\6b7d239558a2b66f533a1c8bf2106093.txt
- %ALLUSERSPROFILE%\52\7113ecffd557a1a61b6f73705234230c.txt
- %ALLUSERSPROFILE%\52\a4af8b70a42b31f1a17d5444297cbec0.txt
- %ALLUSERSPROFILE%\52\b73ea6be64acc1cae356f349fe2916ed.txt
- %ALLUSERSPROFILE%\52\f8315d49ae3a2ef54877bf97e8765bdb.txt
- %ALLUSERSPROFILE%\52\freebl3.dll
- %ALLUSERSPROFILE%\52\mozglue.dll
- %ALLUSERSPROFILE%\52\msvcp140.dll
- %ALLUSERSPROFILE%\52\nss3.dll
- %ALLUSERSPROFILE%\52\softokn3.dll
- %ALLUSERSPROFILE%\52\sqlite3.dll
- %ALLUSERSPROFILE%\52\vcruntime140.dll
- %ALLUSERSPROFILE%\5258
Network activity
TCP
HTTP GET requests
- http://q1#.xyz/api.php
- http://q1#.xyz/api.php?ge######
UDP
- DNS ASK tr#####-solutions.xyz
- DNS ASK ip###ger.org
- DNS ASK q1#.xyz
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\813599.exe'
- '%ALLUSERSPROFILE%\998385.exe'
- '%ALLUSERSPROFILE%\windows host\windows host.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\649979.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\998385.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\649979.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\998385.bat" "
