Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'CSRSS' = '"%ALLUSERSPROFILE%\Drivers\csrss.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent f4796e1deb16ccd5
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\GeoLocationMap65] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\GeoLocationMap65] 'ImagePath' = '%ALLUSERSPROFILE%\GeoLocationMap65\GeoLocationMap65.exe'
Creates the following services
- 'GeoLocationMap65' %ALLUSERSPROFILE%\GeoLocationMap65\GeoLocationMap65.exe
Modifies master boot record (MBR).
Malicious functions
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes
Injects code into
the following user processes:
- c9b4.exe
Modifies file system
Creates the following files
- %APPDATA%\hwsuwhe
- %ALLUSERSPROFILE%\geolocationmap65\geolocationmap65.exe
- %TEMP%\4kpv6a~1\cached-microdesc-consensus.tmp
- %TEMP%\4kpv6a~1\cached-microdescs.new
- %TEMP%\5fbf.exe
- %TEMP%\8bbf.exe
- %TEMP%\is-0fhpf.tmp\is-1tamh.tmp
- %TEMP%\is-4jhim.tmp\_isetup\_setup64.tmp
- %TEMP%\is-4jhim.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-4jhim.tmp\_isdecmp.dll
- %TEMP%\is-4jhim.tmp\_iscrypt.dll
- %LOCALAPPDATA%\python numeric abstract base classes\is-2t8cj.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\is-uj8jb.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\lang\is-59ofe.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\lang\is-16pv4.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\lang\is-q23ts.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\lang\is-fla8o.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\lang\is-k3ole.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\is-dii45.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\is-hkgq1.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\is-daf4j.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\is-iq7bn.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\is-cdbah.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\is-t5tcr.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\is-fdn1l.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\filters\is-v6ro0.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\filters\is-blhev.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\is-n2t62.tmp
- %TEMP%\4kpv6a~1\cached-certs.tmp
- %TEMP%\aa38.exe
- %TEMP%\4kpv6a~1\unverified-microdesc-consensus.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\unins000.dat
- %TEMP%\c9b4.exe
- %ALLUSERSPROFILE%\drivers\csrss.exe
- %TEMP%\4kpv6a~1\state.tmp
- %TEMP%\e984.exe
- %TEMP%\is-r6i8l.tmp\is-ctfb5.tmp
- %TEMP%\is-dp6dg.tmp\_isetup\_setup64.tmp
- %TEMP%\is-dp6dg.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-dp6dg.tmp\_isdecmp.dll
- %TEMP%\is-dp6dg.tmp\_iscrypt.dll
- %TEMP%\f6fd.dll
- %LOCALAPPDATA%\python numeric abstract base classes\is-mb8ks.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\is-psa81.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\lang\is-fpaf2.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\lang\is-60cme.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\lang\is-9u5gk.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\lang\is-skdtq.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\lang\is-fstj2.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\is-a0fth.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\is-lo7j3.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\is-fli55.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\is-bnjul.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\is-sm5qg.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\is-hojj0.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\is-ia6fn.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\filters\is-t7jaj.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\filters\is-a9394.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\is-7p9r4.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\pynumericabstractclasses.exe
- %TEMP%\is-0j5bg.tmp\is-2ls77.tmp
Sets the 'hidden' attribute to the following files
- %APPDATA%\hwsuwhe
- %ALLUSERSPROFILE%\drivers\csrss.exe
Deletes the following files
- %TEMP%\4kpv6a~1\unverified-microdesc-consensus
- %TEMP%\4kpv6a~1\state
- %LOCALAPPDATA%\python numeric abstract base classes\filters\limit.dll
- %LOCALAPPDATA%\python numeric abstract base classes\filters\gain.dll
- %LOCALAPPDATA%\python numeric abstract base classes\sbapo.dll
- %LOCALAPPDATA%\python numeric abstract base classes\sbh64.dll
- %LOCALAPPDATA%\python numeric abstract base classes\sbh.dll
- %LOCALAPPDATA%\python numeric abstract base classes\logger64.dll
- %LOCALAPPDATA%\python numeric abstract base classes\pynumericabstractclasses.exe
- %LOCALAPPDATA%\python numeric abstract base classes\logger32.dll
- %LOCALAPPDATA%\python numeric abstract base classes\turboactivate.dat
- %LOCALAPPDATA%\python numeric abstract base classes\lang\turboactivate.xml
- %LOCALAPPDATA%\python numeric abstract base classes\lang\turboactivatebr.xml
- %LOCALAPPDATA%\python numeric abstract base classes\lang\turboactivateru.xml
- %LOCALAPPDATA%\python numeric abstract base classes\lang\soundboosterbr.dll
- %LOCALAPPDATA%\python numeric abstract base classes\lang\soundboosterru.dll
- %LOCALAPPDATA%\python numeric abstract base classes\ultraactivate.dll
- %LOCALAPPDATA%\python numeric abstract base classes\turboactivate.dll
- %LOCALAPPDATA%\python numeric abstract base classes\is-n2t62.tmp
Moves the following files
- from %TEMP%\4kpv6a~1\state.tmp to %TEMP%\4kpv6a~1\state
- from %TEMP%\4kpv6a~1\unverified-microdesc-consensus.tmp to %TEMP%\4kpv6a~1\unverified-microdesc-consensus
- from %LOCALAPPDATA%\python numeric abstract base classes\is-7p9r4.tmp to %LOCALAPPDATA%\python numeric abstract base classes\pynumericabstractclasses.exe
- from %LOCALAPPDATA%\python numeric abstract base classes\filters\is-a9394.tmp to %LOCALAPPDATA%\python numeric abstract base classes\filters\limit.dll
- from %LOCALAPPDATA%\python numeric abstract base classes\filters\is-t7jaj.tmp to %LOCALAPPDATA%\python numeric abstract base classes\filters\gain.dll
- from %LOCALAPPDATA%\python numeric abstract base classes\is-ia6fn.tmp to %LOCALAPPDATA%\python numeric abstract base classes\sbapo.dll
- from %LOCALAPPDATA%\python numeric abstract base classes\is-hojj0.tmp to %LOCALAPPDATA%\python numeric abstract base classes\sbh64.dll
- from %LOCALAPPDATA%\python numeric abstract base classes\is-sm5qg.tmp to %LOCALAPPDATA%\python numeric abstract base classes\sbh.dll
- from %LOCALAPPDATA%\python numeric abstract base classes\is-bnjul.tmp to %LOCALAPPDATA%\python numeric abstract base classes\logger64.dll
- from %TEMP%\4kpv6a~1\cached-certs.tmp to %TEMP%\4kpv6a~1\cached-certs
- from %LOCALAPPDATA%\python numeric abstract base classes\is-fli55.tmp to %LOCALAPPDATA%\python numeric abstract base classes\logger32.dll
- from %LOCALAPPDATA%\python numeric abstract base classes\is-a0fth.tmp to %LOCALAPPDATA%\python numeric abstract base classes\turboactivate.dat
- from %LOCALAPPDATA%\python numeric abstract base classes\lang\is-fstj2.tmp to %LOCALAPPDATA%\python numeric abstract base classes\lang\turboactivate.xml
- from %LOCALAPPDATA%\python numeric abstract base classes\lang\is-skdtq.tmp to %LOCALAPPDATA%\python numeric abstract base classes\lang\turboactivatebr.xml
- from %LOCALAPPDATA%\python numeric abstract base classes\lang\is-9u5gk.tmp to %LOCALAPPDATA%\python numeric abstract base classes\lang\turboactivateru.xml
- from %LOCALAPPDATA%\python numeric abstract base classes\lang\is-60cme.tmp to %LOCALAPPDATA%\python numeric abstract base classes\lang\soundboosterbr.dll
- from %LOCALAPPDATA%\python numeric abstract base classes\lang\is-fpaf2.tmp to %LOCALAPPDATA%\python numeric abstract base classes\lang\soundboosterru.dll
- from %LOCALAPPDATA%\python numeric abstract base classes\is-psa81.tmp to %LOCALAPPDATA%\python numeric abstract base classes\ultraactivate.dll
- from %LOCALAPPDATA%\python numeric abstract base classes\is-mb8ks.tmp to %LOCALAPPDATA%\python numeric abstract base classes\unins000.exe
- from %LOCALAPPDATA%\python numeric abstract base classes\is-lo7j3.tmp to %LOCALAPPDATA%\python numeric abstract base classes\turboactivate.dll
- from %TEMP%\4kpv6a~1\cached-microdesc-consensus.tmp to %TEMP%\4kpv6a~1\cached-microdesc-consensus
Substitutes the following files
- %LOCALAPPDATA%\python numeric abstract base classes\ultraactivate.dll
- %LOCALAPPDATA%\python numeric abstract base classes\filters\limit.dll
- %LOCALAPPDATA%\python numeric abstract base classes\filters\gain.dll
- %LOCALAPPDATA%\python numeric abstract base classes\sbapo.dll
- %LOCALAPPDATA%\python numeric abstract base classes\sbh64.dll
- %LOCALAPPDATA%\python numeric abstract base classes\sbh.dll
- %LOCALAPPDATA%\python numeric abstract base classes\logger64.dll
- %TEMP%\4kpv6a~1\state.tmp
- %LOCALAPPDATA%\python numeric abstract base classes\logger32.dll
- %LOCALAPPDATA%\python numeric abstract base classes\turboactivate.dat
- %LOCALAPPDATA%\python numeric abstract base classes\lang\turboactivate.xml
- %LOCALAPPDATA%\python numeric abstract base classes\lang\turboactivatebr.xml
- %LOCALAPPDATA%\python numeric abstract base classes\lang\turboactivateru.xml
- %LOCALAPPDATA%\python numeric abstract base classes\lang\soundboosterbr.dll
- %LOCALAPPDATA%\python numeric abstract base classes\lang\soundboosterru.dll
- %LOCALAPPDATA%\python numeric abstract base classes\turboactivate.dll
- %TEMP%\4kpv6a~1\state
Deletes itself.
Network activity
Connects to
- 'se####ation17io.io':80
- 'pa#.##azprak.com':80
- 'localhost':49187
- '10#.#7.231.27':443
- '38.##5.200.61':443
- '18#.#27.82.7':443
- '21#.#2.203.242':443
- '12#.31.0.39':9101
- '93.##.194.106':9001
- '18#.#5.200.250':9001
- 'se##.#partabig.com':80
- 'localhost':19354
- '18#.#72.128.19':80
TCP
HTTP GET requests
- http://pa#.##azprak.com/order/tuc5.exe
- http://se##.#partabig.com/order/tuc5.exe
- http://x5###############dj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onion/upd.php?n=#################################################################################################################...
- http://x5###############dj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onion/task.php?n=################################################################################################################...
- http://18#.#72.128.19/288c47bbc1871b439df19ff4df68f0766.exe
- http://x5###############dj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onion/reg.php?n=#####################################################
HTTP POST requests
- http://se####ation17io.io/index.php
Other
- '21#.#2.203.242':443
- '93.##.194.106':9001
- '18#.#5.200.250':9001
- 'localhost':19354
- 'localhost':49198
- 'localhost':49200
- 'localhost':49202
- 'localhost':49203
UDP
- DNS ASK se####ation17io.io
- DNS ASK pa#.##azprak.com
- DNS ASK se##.#partabig.com
Miscellaneous
Searches for the following windows
- ClassName: 'j3d3fd_PYNUM1273FlashFixClass_j3d3fd' WindowName: ''
Creates and executes the following
- '%TEMP%\c9b4.exe'
- '%TEMP%\aa38.exe'
- '%TEMP%\is-0fhpf.tmp\is-1tamh.tmp' /SL4 $3027E "%TEMP%\8BBF.exe" 6817370 52224
- '%TEMP%\8bbf.exe'
- '%LOCALAPPDATA%\python numeric abstract base classes\pynumericabstractclasses.exe' -s
- '%TEMP%\5fbf.exe'
- '%LOCALAPPDATA%\python numeric abstract base classes\pynumericabstractclasses.exe' -i
- '%TEMP%\is-r6i8l.tmp\is-ctfb5.tmp' /SL4 $E0264 "%TEMP%\E984.exe" 6817370 52224
- '%TEMP%\e984.exe'
- '%TEMP%\is-0j5bg.tmp\is-2ls77.tmp' /SL4 $102C4 "%TEMP%\AA38.exe" 6296987 52224
- '%TEMP%\csrss\patch.exe' ' (with hidden window)
- '<SYSTEM32>\bcdedit.exe' /v' (with hidden window)
- '%WINDIR%\windefender.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\Temp\Task.bat" "' (with hidden window)
- '%WINDIR%\rss\csrss.exe' ' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /CREATE /SC ONLOGON /RL HIGHEST /TR "%WINDIR%\rss\csrss.exe" /TN csrss /F' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /delete /tn ScheduledUpdate /f' (with hidden window)
- '%TEMP%\csrss\injector\injector.exe' taskmgr.exe %TEMP%\csrss\injector\NtQuerySystemInformationHook.dll' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)' (with hidden window)
Executes the following
- '<SYSTEM32>\regsvr32.exe' /s %TEMP%\F6FD.dll
- '%WINDIR%\syswow64\schtasks.exe' /Query
- '<SYSTEM32>\cmd.exe' /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes"
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\Temp\Task.bat" "
- '%WINDIR%\syswow64\chcp.com' 1251
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "MalayamaraUpdate" /tr "'%TEMP%\Updater.exe'" /sc minute /mo 30 /F
- '<SYSTEM32>\schtasks.exe' /CREATE /SC ONLOGON /RL HIGHEST /TR "%WINDIR%\rss\csrss.exe" /TN csrss /F
- '<SYSTEM32>\schtasks.exe' /delete /tn ScheduledUpdate /f
- '<SYSTEM32>\bcdedit.exe' /v
- '%WINDIR%\syswow64\cmd.exe' /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
- '%WINDIR%\syswow64\sc.exe' sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
