Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Host' = '%ALLUSERSPROFILE%\Windows Host\Windows Host.exe'
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\7220315.79
- %TEMP%\tmp5b0e.tmp
- %TEMP%\tmp5b0d.tmp
- %TEMP%\tmp5b0c.tmp
- %TEMP%\tmp5afb.tmp
- %TEMP%\tmp5afa.tmp
- %TEMP%\tmp5af9.tmp
- %ALLUSERSPROFILE%\74\72caaaafa5ea8fa873837bd878100d86.txt
- %TEMP%\tmp5ae9.tmp
- %TEMP%\tmp5ae8.tmp
- %TEMP%\tmp5ae7.tmp
- %TEMP%\tmp5ad6.tmp
- %ALLUSERSPROFILE%\74\051cc88672ebfbfafcac4d1a5007460a.txt
- %TEMP%\tmp5ab6.tmp
- %ALLUSERSPROFILE%\74\5769f9da53f8a2494c01f9fa93afc33f.txt
- %TEMP%\tmp5a96.tmp
- %TEMP%\tmp5a95.tmp
- %TEMP%\tmp5a46.tmp
- %TEMP%\tmp5a16.tmp
- %TEMP%\tmp59f6.tmp
- %TEMP%\tmp59f5.tmp
- %TEMP%\tmp59f4.tmp
- %TEMP%\tmp59e3.tmp
- %TEMP%\tmp59e2.tmp
- %TEMP%\tmp59e1.tmp
- %TEMP%\tmp59d1.tmp
- %TEMP%\tmp59d0.tmp
- %TEMP%\tmp59cf.tmp
- %TEMP%\tmp5b0f.tmp
- %ALLUSERSPROFILE%\74\82792a7516ae93a152ee8e4967dd57bd.txt
- %TEMP%\tmp5bc7.tmp
- %TEMP%\tmp5b21.tmp
- %ALLUSERSPROFILE%\74\b7e4ef6d042a3d05593e0734161abf52.txt
- %TEMP%\tmp5bc6.tmp
- %TEMP%\tmp5bc5.tmp
- %TEMP%\tmp5bc4.tmp
- %TEMP%\tmp5bc3.tmp
- %TEMP%\tmp5bb2.tmp
- %TEMP%\tmp5bb1.tmp
- %TEMP%\tmp5bb0.tmp
- %TEMP%\tmp5baf.tmp
- %TEMP%\tmp5bae.tmp
- %TEMP%\tmp5b9e.tmp
- %TEMP%\tmp5b9d.tmp
- %TEMP%\tmp5b9c.tmp
- %TEMP%\tmp5b9b.tmp
- %TEMP%\tmp5b8a.tmp
- %TEMP%\tmp5b89.tmp
- %TEMP%\tmp5b88.tmp
- %TEMP%\tmp5b78.tmp
- %TEMP%\tmp5b77.tmp
- %ALLUSERSPROFILE%\74\b47aa3efbc7d974a7d5da8269b65149e.txt
- %TEMP%\tmp5b47.tmp
- %TEMP%\tmp5b46.tmp
- %TEMP%\tmp5b45.tmp
- %TEMP%\tmp5b34.tmp
- %TEMP%\tmp5b33.tmp
- %TEMP%\tmp5b32.tmp
- %TEMP%\tmp5b31.tmp
- %TEMP%\tmp59be.tmp
- %TEMP%\tmp5b20.tmp
- %TEMP%\tmp59bd.tmp
- %TEMP%\tmp5911.tmp
- %TEMP%\tmp5892.tmp
- %TEMP%\tmp5891.tmp
- %TEMP%\tmp5880.tmp
- %TEMP%\tmp587f.tmp
- %TEMP%\tmp586f.tmp
- %TEMP%\tmp586e.tmp
- %TEMP%\tmp57e0.tmp
- %TEMP%\tmp56d6.tmp
- %ALLUSERSPROFILE%\69\nss3.dll
- %ALLUSERSPROFILE%\69\msvcp140.dll
- %ALLUSERSPROFILE%\69\mozglue.dll
- %ALLUSERSPROFILE%\69\freebl3.dll
- %ALLUSERSPROFILE%\69\vcruntime140.dll
- %ALLUSERSPROFILE%\69\sqlite3.dll
- %ALLUSERSPROFILE%\69\softokn3.dll
- %ALLUSERSPROFILE%\6984
- %ALLUSERSPROFILE%\74\nss3.dll
- %ALLUSERSPROFILE%\74\msvcp140.dll
- %ALLUSERSPROFILE%\74\mozglue.dll
- %ALLUSERSPROFILE%\74\freebl3.dll
- %ALLUSERSPROFILE%\74\vcruntime140.dll
- %ALLUSERSPROFILE%\74\sqlite3.dll
- %ALLUSERSPROFILE%\74\softokn3.dll
- %ALLUSERSPROFILE%\7492
- %ALLUSERSPROFILE%\windows host\windows host.exe
- %ALLUSERSPROFILE%\4620815.50
- %ALLUSERSPROFILE%\1923554.21
- %TEMP%\tmp58d1.tmp
- %TEMP%\tmp5912.tmp
- %TEMP%\tmp59ab.tmp
- %TEMP%\tmp5913.tmp
- %TEMP%\tmp59aa.tmp
- %TEMP%\tmp59a9.tmp
- %TEMP%\tmp59a8.tmp
- %TEMP%\tmp5998.tmp
- %TEMP%\tmp5997.tmp
- %TEMP%\tmp5996.tmp
- %TEMP%\tmp5995.tmp
- %TEMP%\tmp5984.tmp
- %TEMP%\tmp5983.tmp
- %TEMP%\tmp5982.tmp
- %TEMP%\tmp5981.tmp
- %TEMP%\tmp5971.tmp
- %TEMP%\tmp5970.tmp
- %TEMP%\tmp596f.tmp
- %TEMP%\tmp596e.tmp
- %TEMP%\tmp595d.tmp
- %TEMP%\tmp595c.tmp
- %TEMP%\tmp595b.tmp
- %TEMP%\tmp595a.tmp
- %TEMP%\tmp5949.tmp
- %TEMP%\tmp5948.tmp
- %TEMP%\tmp5947.tmp
- %TEMP%\tmp5937.tmp
- %TEMP%\tmp5936.tmp
- %TEMP%\tmp5925.tmp
- %TEMP%\tmp5924.tmp
- %TEMP%\tmp5923.tmp
- %TEMP%\tmp59bc.tmp
- %ALLUSERSPROFILE%\73066.73066
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\windows host\windows host.exe
Deletes the following files
- %TEMP%\tmp57e0.tmp
- %TEMP%\tmp5b21.tmp
- %TEMP%\tmp5b32.tmp
- %TEMP%\tmp5b34.tmp
- %TEMP%\tmp5b46.tmp
- %TEMP%\tmp5b77.tmp
- %TEMP%\tmp5b88.tmp
- %TEMP%\tmp5b8a.tmp
- %TEMP%\tmp5b9c.tmp
- %TEMP%\tmp5b9e.tmp
- %TEMP%\tmp5baf.tmp
- %TEMP%\tmp5bb1.tmp
- %TEMP%\tmp5bc3.tmp
- %TEMP%\tmp5984.tmp
- %TEMP%\tmp5bc5.tmp
- %ALLUSERSPROFILE%\74\051cc88672ebfbfafcac4d1a5007460a.txt
- %ALLUSERSPROFILE%\74\5769f9da53f8a2494c01f9fa93afc33f.txt
- %ALLUSERSPROFILE%\74\72caaaafa5ea8fa873837bd878100d86.txt
- %ALLUSERSPROFILE%\74\82792a7516ae93a152ee8e4967dd57bd.txt
- %ALLUSERSPROFILE%\74\b47aa3efbc7d974a7d5da8269b65149e.txt
- %ALLUSERSPROFILE%\74\b7e4ef6d042a3d05593e0734161abf52.txt
- %ALLUSERSPROFILE%\74\freebl3.dll
- %ALLUSERSPROFILE%\74\mozglue.dll
- %ALLUSERSPROFILE%\74\msvcp140.dll
- %ALLUSERSPROFILE%\74\nss3.dll
- %ALLUSERSPROFILE%\74\softokn3.dll
- %ALLUSERSPROFILE%\74\sqlite3.dll
- %TEMP%\tmp5b0d.tmp
- %TEMP%\tmp5b0f.tmp
- %TEMP%\tmp5afb.tmp
- %TEMP%\tmp5af9.tmp
- %TEMP%\tmp5ae8.tmp
- %TEMP%\tmp5880.tmp
- %TEMP%\tmp5892.tmp
- %TEMP%\tmp5911.tmp
- %TEMP%\tmp5913.tmp
- %TEMP%\tmp5924.tmp
- %TEMP%\tmp5936.tmp
- %TEMP%\tmp5947.tmp
- %TEMP%\tmp5949.tmp
- %TEMP%\tmp595b.tmp
- %TEMP%\tmp595d.tmp
- %TEMP%\tmp596f.tmp
- %TEMP%\tmp5971.tmp
- %ALLUSERSPROFILE%\74\vcruntime140.dll
- %TEMP%\tmp5bc7.tmp
- %TEMP%\tmp5982.tmp
- %TEMP%\tmp5998.tmp
- %TEMP%\tmp59a9.tmp
- %TEMP%\tmp59ab.tmp
- %TEMP%\tmp59bd.tmp
- %TEMP%\tmp59cf.tmp
- %TEMP%\tmp59d1.tmp
- %TEMP%\tmp59e2.tmp
- %TEMP%\tmp59f4.tmp
- %TEMP%\tmp59f6.tmp
- %TEMP%\tmp5a46.tmp
- %TEMP%\tmp5a96.tmp
- %TEMP%\tmp5ad6.tmp
- %TEMP%\tmp586f.tmp
- %TEMP%\tmp5996.tmp
- %ALLUSERSPROFILE%\7492
Network activity
Connects to
- 'mi####dollars.xyz':443
- 'ip###ger.org':443
- 'microsoft.com':80
TCP
- 'mi####dollars.xyz':443
- 'ip###ger.org':443
- 'je####usbrain.xyz':443
- 'mo##yom.xyz':443
- 'mu###islife.xyz':443
UDP
- DNS ASK mi####dollars.xyz
- DNS ASK ip###ger.org
- DNS ASK je####usbrain.xyz
- DNS ASK microsoft.com
- DNS ASK mo##yom.xyz
- DNS ASK mu###islife.xyz
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\7220315.79'
- '%ALLUSERSPROFILE%\1923554.21'
- '%ALLUSERSPROFILE%\4620815.50'
- '%ALLUSERSPROFILE%\windows host\windows host.exe'
