Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Host' = '%ALLUSERSPROFILE%\Windows Host\Windows Host.exe'
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\941142.exe
- %ALLUSERSPROFILE%\41\767ed6404eafb925a9d5c7b78b9d565a.txt
- %ALLUSERSPROFILE%\41\d8363ae7b7d3f7410a20aa8c64c0f0d5.txt
- %ALLUSERSPROFILE%\41\cf0a4365b50b31139251367a408a8ec8.txt
- %ALLUSERSPROFILE%\41\89709c56437403a0e6c6f2cd83736425.txt
- %ALLUSERSPROFILE%\41\nss3.dll
- %ALLUSERSPROFILE%\41\msvcp140.dll
- %ALLUSERSPROFILE%\41\mozglue.dll
- %ALLUSERSPROFILE%\41\2f0417c207df32b29c9894434b01f102.txt
- %ALLUSERSPROFILE%\41\freebl3.dll
- %ALLUSERSPROFILE%\41\sqlite3.dll
- %ALLUSERSPROFILE%\41\softokn3.dll
- %ALLUSERSPROFILE%\4142
- %ALLUSERSPROFILE%\windows host\windows host.exe
- %ALLUSERSPROFILE%\542713.bat
- %ALLUSERSPROFILE%\183908.exe
- %ALLUSERSPROFILE%\777522.bat
- %ALLUSERSPROFILE%\41\vcruntime140.dll
- %ALLUSERSPROFILE%\41\f43270c0d6d824a313da2dc5ea39cd67.txt
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\windows host\windows host.exe
Deletes the following files
- %ALLUSERSPROFILE%\41\2f0417c207df32b29c9894434b01f102.txt
- %ALLUSERSPROFILE%\41\767ed6404eafb925a9d5c7b78b9d565a.txt
- %ALLUSERSPROFILE%\41\89709c56437403a0e6c6f2cd83736425.txt
- %ALLUSERSPROFILE%\41\cf0a4365b50b31139251367a408a8ec8.txt
- %ALLUSERSPROFILE%\41\d8363ae7b7d3f7410a20aa8c64c0f0d5.txt
- %ALLUSERSPROFILE%\41\f43270c0d6d824a313da2dc5ea39cd67.txt
- %ALLUSERSPROFILE%\41\freebl3.dll
- %ALLUSERSPROFILE%\41\mozglue.dll
- %ALLUSERSPROFILE%\41\msvcp140.dll
- %ALLUSERSPROFILE%\41\nss3.dll
- %ALLUSERSPROFILE%\41\softokn3.dll
- %ALLUSERSPROFILE%\41\sqlite3.dll
- %ALLUSERSPROFILE%\41\vcruntime140.dll
- %ALLUSERSPROFILE%\4142
Network activity
TCP
- 'jo###soft.xyz':443
- 'ip###ger.org':443
- 'au##sft.xyz':443
UDP
- DNS ASK jo###soft.xyz
- DNS ASK ip###ger.org
- DNS ASK au##sft.xyz
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\941142.exe'
- '%ALLUSERSPROFILE%\183908.exe'
- '%ALLUSERSPROFILE%\windows host\windows host.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\777522.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\542713.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\777522.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\542713.bat" "
