Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WinHost' = '%APPDATA%\WinHost\WinHoster.exe'
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %APPDATA%\8171144.exe
- %TEMP%\tmp485b.tmp
- %TEMP%\tmp485a.tmp
- %TEMP%\tmp4849.tmp
- %TEMP%\tmp4848.tmp
- %TEMP%\tmp4838.tmp
- %TEMP%\tmp4837.tmp
- %TEMP%\tmp4836.tmp
- %TEMP%\tmp4825.tmp
- %TEMP%\tmp4814.tmp
- %TEMP%\tmp4813.tmp
- %TEMP%\tmp4803.tmp
- %TEMP%\tmp4802.tmp
- %TEMP%\tmp47f1.tmp
- %TEMP%\tmp47f0.tmp
- %TEMP%\tmp47e0.tmp
- %TEMP%\tmp47df.tmp
- %TEMP%\tmp47de.tmp
- %TEMP%\tmp47cd.tmp
- %TEMP%\tmp47cc.tmp
- %TEMP%\tmp47cb.tmp
- %TEMP%\tmp47ba.tmp
- %TEMP%\tmp486b.tmp
- %TEMP%\tmp487d.tmp
- %TEMP%\tmp4911.tmp
- %TEMP%\tmp487e.tmp
- %TEMP%\tmp4910.tmp
- %TEMP%\tmp48ff.tmp
- %TEMP%\tmp48fe.tmp
- %TEMP%\tmp48fd.tmp
- %TEMP%\tmp48ed.tmp
- %TEMP%\tmp48ec.tmp
- %TEMP%\tmp48eb.tmp
- %TEMP%\tmp48da.tmp
- %TEMP%\tmp48d9.tmp
- %TEMP%\tmp48d8.tmp
- %TEMP%\tmp48c7.tmp
- %TEMP%\tmp48c6.tmp
- %TEMP%\tmp48c5.tmp
- %TEMP%\tmp48b5.tmp
- %TEMP%\tmp48b4.tmp
- %TEMP%\tmp48a3.tmp
- %TEMP%\tmp48a2.tmp
- %TEMP%\tmp48a1.tmp
- %TEMP%\tmp48a0.tmp
- %TEMP%\tmp4890.tmp
- %TEMP%\tmp488f.tmp
- %TEMP%\tmp47b9.tmp
- %TEMP%\tmp487c.tmp
- %TEMP%\tmp47a9.tmp
- %TEMP%\tmp46b4.tmp
- %TEMP%\tmp46a3.tmp
- %TEMP%\tmp4692.tmp
- %TEMP%\tmp4691.tmp
- %TEMP%\tmp4681.tmp
- %TEMP%\tmp4680.tmp
- %TEMP%\tmp466f.tmp
- %TEMP%\tmp466e.tmp
- %TEMP%\tmp465d.tmp
- %TEMP%\tmp464d.tmp
- %TEMP%\tmp464c.tmp
- %TEMP%\tmp464b.tmp
- %TEMP%\tmp462b.tmp
- %TEMP%\tmp461a.tmp
- %TEMP%\tmp4609.tmp
- %TEMP%\tmp45f9.tmp
- %TEMP%\tmp45f8.tmp
- %TEMP%\tmp45e7.tmp
- %TEMP%\tmp455a.tmp
- %TEMP%\tmp42f8.tmp
- %APPDATA%\winhost\winhoster.exe
- %APPDATA%\1008565.exe
- %TEMP%\tmp46a4.tmp
- %TEMP%\tmp46b5.tmp
- %TEMP%\tmp4797.tmp
- %TEMP%\tmp46c6.tmp
- %TEMP%\tmp4796.tmp
- %TEMP%\tmp4786.tmp
- %TEMP%\tmp4785.tmp
- %TEMP%\tmp4774.tmp
- %TEMP%\tmp4773.tmp
- %TEMP%\tmp4772.tmp
- %TEMP%\tmp4761.tmp
- %TEMP%\tmp4732.tmp
- %TEMP%\tmp4731.tmp
- %TEMP%\tmp4730.tmp
- %TEMP%\tmp471f.tmp
- %TEMP%\tmp471e.tmp
- %TEMP%\tmp471d.tmp
- %TEMP%\tmp470c.tmp
- %TEMP%\tmp470b.tmp
- %TEMP%\tmp46fb.tmp
- %TEMP%\tmp46fa.tmp
- %TEMP%\tmp46e9.tmp
- %TEMP%\tmp46e8.tmp
- %TEMP%\tmp46d8.tmp
- %TEMP%\tmp46d7.tmp
- %TEMP%\tmp47a8.tmp
- %TEMP%\tmp4921.tmp
Sets the 'hidden' attribute to the following files
- %APPDATA%\winhost\winhoster.exe
Deletes the following files
- %TEMP%\tmp455a.tmp
- %TEMP%\tmp47f0.tmp
- %TEMP%\tmp4802.tmp
- %TEMP%\tmp4813.tmp
- %TEMP%\tmp4825.tmp
- %TEMP%\tmp4837.tmp
- %TEMP%\tmp4848.tmp
- %TEMP%\tmp485a.tmp
- %TEMP%\tmp486b.tmp
- %TEMP%\tmp47cd.tmp
- %TEMP%\tmp47df.tmp
- %TEMP%\tmp487d.tmp
- %TEMP%\tmp48a2.tmp
- %TEMP%\tmp48b4.tmp
- %TEMP%\tmp48c5.tmp
- %TEMP%\tmp48c7.tmp
- %TEMP%\tmp48d9.tmp
- %TEMP%\tmp48eb.tmp
- %TEMP%\tmp48ed.tmp
- %TEMP%\tmp48fe.tmp
- %TEMP%\tmp488f.tmp
- %TEMP%\tmp48a0.tmp
- %TEMP%\tmp47cb.tmp
- %TEMP%\tmp47b9.tmp
- %TEMP%\tmp47a8.tmp
- %TEMP%\tmp4609.tmp
- %TEMP%\tmp462b.tmp
- %TEMP%\tmp464c.tmp
- %TEMP%\tmp465d.tmp
- %TEMP%\tmp466f.tmp
- %TEMP%\tmp4681.tmp
- %TEMP%\tmp4692.tmp
- %TEMP%\tmp46a4.tmp
- %TEMP%\tmp46b5.tmp
- %TEMP%\tmp45f8.tmp
- %TEMP%\tmp46d7.tmp
- %TEMP%\tmp46fa.tmp
- %TEMP%\tmp470b.tmp
- %TEMP%\tmp471d.tmp
- %TEMP%\tmp471f.tmp
- %TEMP%\tmp4731.tmp
- %TEMP%\tmp4761.tmp
- %TEMP%\tmp4773.tmp
- %TEMP%\tmp4785.tmp
- %TEMP%\tmp4796.tmp
- %TEMP%\tmp46e8.tmp
- %TEMP%\tmp4910.tmp
- %TEMP%\tmp4921.tmp
Network activity
Connects to
- 'ga###etwork.bar':443
- 'ip###ger.org':443
- 'microsoft.com':80
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Other
- 'ga###etwork.bar':443
- 'ip###ger.org':443
UDP
- DNS ASK ga###etwork.bar
- DNS ASK ip###ger.org
- DNS ASK mr####e-support.xyz
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\8171144.exe'
- '%APPDATA%\1008565.exe'
- '%APPDATA%\winhost\winhoster.exe'
- '%APPDATA%\8171144.exe' ' (with hidden window)
- '%APPDATA%\1008565.exe' ' (with hidden window)
