Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'sppsvc' = '"<SYSTEM32>\mscpxl32\sppsvc.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'spoolsv' = '"<SYSTEM32>\KBDVNTC\spoolsv.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'lsass' = '"C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\lsass.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'smss' = '"<SYSTEM32>\oleprn\smss.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'sppsvc' = '"<SYSTEM32>\KBDUGHR1\sppsvc.exe"'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"<SYSTEM32>\KBDSW09\csrss.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\sppsvc
- <SYSTEM32>\tasks\spoolsv
- <SYSTEM32>\tasks\lsass
- <SYSTEM32>\tasks\smss
- <SYSTEM32>\tasks\csrss
Malicious functions
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %WINDIR%\syswow64\mscpxl32\sppsvc.exe
- %TEMP%\1gysjkzhmu
- %TEMP%\gcbqtip4mh
- %TEMP%\qrsix3brzd
- %TEMP%\smuxfpzqdf
- %TEMP%\sysjbdgtap
- %TEMP%\nt5r916rqp
- %TEMP%\h7dnly0y7c
- %TEMP%\n6zzucjswb
- %TEMP%\uqzmmd3p3g
- %TEMP%\wjwxosuoa6
- %TEMP%\jp4izuumu0
- %TEMP%\f4jcqubp2g
- %TEMP%\zlgjvhczt6
- %TEMP%\zozsqlqogf
- %TEMP%\iqqg6x4rz4
- %WINDIR%\syswow64\kbdsw09\886983d96e3d3e31032c679b2d4ea91b6c05afef
- %WINDIR%\syswow64\kbdsw09\csrss.exe
- %WINDIR%\syswow64\kbdughr1\0a1fd5f707cd16ea89afd3d6db52b2da58214a6c
- %WINDIR%\syswow64\kbdughr1\sppsvc.exe
- %WINDIR%\syswow64\oleprn\69ddcba757bf72f7d36c464c71f42baab150b2b9
- %WINDIR%\syswow64\oleprn\smss.exe
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\lsass.exe
- %WINDIR%\syswow64\kbdvntc\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4
- %WINDIR%\syswow64\kbdvntc\spoolsv.exe
- %WINDIR%\syswow64\mscpxl32\0a1fd5f707cd16ea89afd3d6db52b2da58214a6c
- %TEMP%\y23kn3rqqk
- %TEMP%\j0kno6zfof
Deletes the following files
- %TEMP%\iqqg6x4rz4
- %TEMP%\1gysjkzhmu
- %TEMP%\gcbqtip4mh
- %TEMP%\qrsix3brzd
- %TEMP%\smuxfpzqdf
- %TEMP%\sysjbdgtap
- %TEMP%\nt5r916rqp
- %TEMP%\zlgjvhczt6
- %TEMP%\h7dnly0y7c
- %TEMP%\uqzmmd3p3g
- %TEMP%\wjwxosuoa6
- %TEMP%\jp4izuumu0
- %TEMP%\f4jcqubp2g
- %TEMP%\zozsqlqogf
- %TEMP%\y23kn3rqqk
- %TEMP%\n6zzucjswb
- %TEMP%\j0kno6zfof
Network activity
Connects to
- '92.##9.112.175':80
TCP
HTTP GET requests
- http://92.##9.112.175/VideoLinux.php?Hc##########################################################################################################################################################...
Miscellaneous
Creates and executes the following
- 'C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\lsass.exe'
- 'C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\lsass.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "sppsvc" /sc ONLOGON /tr "'<SYSTEM32>\mscpxl32\sppsvc.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'<SYSTEM32>\KBDVNTC\spoolsv.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'<SYSTEM32>\oleprn\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "sppsvc" /sc ONLOGON /tr "'<SYSTEM32>\KBDUGHR1\sppsvc.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'<SYSTEM32>\KBDSW09\csrss.exe'" /rl HIGHEST /f
