Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Host' = '%ALLUSERSPROFILE%\Windows Host\Windows Host.exe'
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\484977.exe
- %ALLUSERSPROFILE%\78\4377f798d664a236c13959a16d4bfacf.txt
- %ALLUSERSPROFILE%\78\9e211f8bde5d3db1823fc5a258775de5.txt
- %ALLUSERSPROFILE%\78\b48296210a62eadd56ae9dd2d1b4205c.txt
- %ALLUSERSPROFILE%\78\nss3.dll
- %ALLUSERSPROFILE%\78\msvcp140.dll
- %ALLUSERSPROFILE%\78\mozglue.dll
- %ALLUSERSPROFILE%\78\freebl3.dll
- %ALLUSERSPROFILE%\78\vcruntime140.dll
- %ALLUSERSPROFILE%\78\sqlite3.dll
- %ALLUSERSPROFILE%\78\softokn3.dll
- %ALLUSERSPROFILE%\7897
- %ALLUSERSPROFILE%\windows host\windows host.exe
- %ALLUSERSPROFILE%\643840.bat
- %ALLUSERSPROFILE%\643840.exe
- %ALLUSERSPROFILE%\321357.bat
- %ALLUSERSPROFILE%\78\5e78d2d9abc00333ac95645cbc6f5162.txt
- %ALLUSERSPROFILE%\78\693dec5076de9924ea4a5d5d764a1610.txt
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\windows host\windows host.exe
Deletes the following files
- %ALLUSERSPROFILE%\78\4377f798d664a236c13959a16d4bfacf.txt
- %ALLUSERSPROFILE%\78\5e78d2d9abc00333ac95645cbc6f5162.txt
- %ALLUSERSPROFILE%\78\693dec5076de9924ea4a5d5d764a1610.txt
- %ALLUSERSPROFILE%\78\9e211f8bde5d3db1823fc5a258775de5.txt
- %ALLUSERSPROFILE%\78\b48296210a62eadd56ae9dd2d1b4205c.txt
- %ALLUSERSPROFILE%\78\freebl3.dll
- %ALLUSERSPROFILE%\78\mozglue.dll
- %ALLUSERSPROFILE%\78\msvcp140.dll
- %ALLUSERSPROFILE%\78\nss3.dll
- %ALLUSERSPROFILE%\78\softokn3.dll
- %ALLUSERSPROFILE%\78\sqlite3.dll
- %ALLUSERSPROFILE%\78\vcruntime140.dll
- %ALLUSERSPROFILE%\7897
Network activity
TCP
- 'jo###soft.xyz':443
- 'ip###ger.org':443
- 'g2##.xyz':443
UDP
- DNS ASK jo###soft.xyz
- DNS ASK ip###ger.org
- DNS ASK g2##.xyz
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\484977.exe'
- '%ALLUSERSPROFILE%\643840.exe'
- '%ALLUSERSPROFILE%\windows host\windows host.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\321357.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\643840.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\321357.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\643840.bat" "
