Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'CSRSS' = '"%ALLUSERSPROFILE%\Drivers\csrss.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"%WINDIR%\rss\csrss.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 111441f3f47727c3
- %WINDIR%\tasks\explorgu.job
- <SYSTEM32>\tasks\malayamaraupdate
- <SYSTEM32>\tasks\csrss
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\MailboxNotifier_65] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\MailboxNotifier_65] 'ImagePath' = '%ALLUSERSPROFILE%\MailboxNotifier_65\MailboxNotifier_65.exe'
- [HKLM\System\CurrentControlSet\Services\VBoxWddm] 'ImagePath' = 'VBoxWddm'
- [HKLM\System\CurrentControlSet\Services\VBoxSF] 'ImagePath' = 'VBoxSF'
- [HKLM\System\CurrentControlSet\Services\VBoxMouse] 'ImagePath' = 'VBoxMouse'
- [HKLM\System\CurrentControlSet\Services\VBoxGuest] 'ImagePath' = 'VBoxGuest'
- [HKLM\System\CurrentControlSet\Services\VBoxService] 'ImagePath' = 'VBoxService'
- [HKLM\System\CurrentControlSet\Services\VBoxVideo] 'ImagePath' = 'VBoxVideo'
Creates the following services
- 'MailboxNotifier_65' %ALLUSERSPROFILE%\MailboxNotifier_65\MailboxNotifier_65.exe
- 'VBoxWddm' VBoxWddm
- 'VBoxSF' VBoxSF
- 'VBoxMouse' VBoxMouse
- 'VBoxGuest' VBoxGuest
- 'VBoxService' VBoxService
- 'VBoxVideo' VBoxVideo
Modifies master boot record (MBR).
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\rss' = '00000000'
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\csrss' = '00000000'
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\windefender.exe' = '00000000'
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '<DRIVERS>' = '00000000'
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes] 'csrss.exe' = '00000000'
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes] 'windefender.exe' = '00000000'
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes] '288c47bbc1871b439df19ff4df68f076.exe' = '00000000'
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes
Injects code into
the following user processes:
- bf40.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %APPDATA%\hwrfsbc
- %LOCALAPPDATA%\mail box stat view\is-mffpa.tmp
- %LOCALAPPDATA%\mail box stat view\is-seca2.tmp
- %LOCALAPPDATA%\mail box stat view\is-c84jv.tmp
- %LOCALAPPDATA%\mail box stat view\is-p3mkp.tmp
- %LOCALAPPDATA%\mail box stat view\unins000.dat
- %LOCALAPPDATA%\mail box stat view\mailboxstatview.exe
- %TEMP%\288c47bbc1871b439df19ff4df68f076.exe
- %TEMP%\u1b8.0.exe
- %TEMP%\u1b8.1.exe
- %TEMP%\bf40.exe
- %ALLUSERSPROFILE%\mailboxnotifier_65\mailboxnotifier_65.exe
- %APPDATA%\temp\task.bat
- %ALLUSERSPROFILE%\drivers\csrss.exe
- %TEMP%\4kpv6a~1\state.tmp
- %WINDIR%\rss\csrss.exe
- %LOCALAPPDATA%\mail box stat view\is-jnkck.tmp
- nul
- %LOCALAPPDATA%\mail box stat view\is-0i6db.tmp
- %LOCALAPPDATA%\mail box stat view\is-gt1ed.tmp
- %TEMP%\3562.exe
- %TEMP%\420f.dll
- %TEMP%\567a.exe
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_d99ef00b-ccd3-4f1d-9980-90ac453b0b47
- %TEMP%\6347.exe
- %TEMP%\00c07260dc\explorgu.exe
- %TEMP%\8e8d.exe
- %TEMP%\94d4.exe
- %TEMP%\is-hgdmd.tmp\94d4.tmp
- %TEMP%\is-3mlr1.tmp\_isetup\_setup64.tmp
- %TEMP%\is-3mlr1.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-3mlr1.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-3mlr1.tmp\_isetup\_iscrypt.dll
- %TEMP%\installsetup_four.exe
- %TEMP%\9ace.exe
- %LOCALAPPDATA%\mail box stat view\is-sqokh.tmp
- %TEMP%\csrss\patch.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\hwrfsbc
- %ALLUSERSPROFILE%\drivers\csrss.exe
Deletes the following files
- %LOCALAPPDATA%\mail box stat view\libgcc_s_dw2-1.dll
- %TEMP%\420f.dll
- %TEMP%\csrss\patch.exe
- %TEMP%\4kpv6a~1\state
Moves the following files
- from %LOCALAPPDATA%\mail box stat view\is-gt1ed.tmp to %LOCALAPPDATA%\mail box stat view\unins000.exe
- from %LOCALAPPDATA%\mail box stat view\is-sqokh.tmp to %LOCALAPPDATA%\mail box stat view\libgcc_s_dw2-1.dll
- from %LOCALAPPDATA%\mail box stat view\is-jnkck.tmp to %LOCALAPPDATA%\mail box stat view\libogg-0.dll
- from %LOCALAPPDATA%\mail box stat view\is-mffpa.tmp to %LOCALAPPDATA%\mail box stat view\libvorbis-0.dll
- from %LOCALAPPDATA%\mail box stat view\is-seca2.tmp to %LOCALAPPDATA%\mail box stat view\libwinpthread-1.dll
- from %LOCALAPPDATA%\mail box stat view\is-c84jv.tmp to %LOCALAPPDATA%\mail box stat view\libbz2-1.dll
- from %LOCALAPPDATA%\mail box stat view\is-p3mkp.tmp to %LOCALAPPDATA%\mail box stat view\mailboxstatview.exe
- from %TEMP%\4kpv6a~1\state.tmp to %TEMP%\4kpv6a~1\state
Substitutes the following files
- %LOCALAPPDATA%\mail box stat view\libgcc_s_dw2-1.dll
- %TEMP%\4kpv6a~1\state
Deletes itself.
Network activity
Connects to
- 'se####ation17io.io':80
- '18#.#15.113.45':80
- 'tr##c.com':80
- '18#.#72.128.19':80
- 'ni###.bestsup.su':80
- '18#.#72.128.90':80
- '18#.#72.128.127':80
- '18#.#72.128.109':80
- '18#.#72.128.145':80
- 'localhost':49195
- '82.##5.59.127':9001
- '19#.#89.96.148':443
- '18#.#6.207.181':19001
- '12#.#68.18.172':9001
- '15#.#5.175.225':443
TCP
HTTP GET requests
- http://18#.#15.113.45/mine/amert.exe
- http://tr##c.com/check/index.php
- http://18#.#72.128.19/288c47bbc1871b439df19ff4df68f07776.exe
- http://ni###.bestsup.su/data/pdf/may.exe
- http://18#.#72.128.90/cpa/ping.php?su####################
- http://18#.#72.128.127/syncUpd.exe
- http://18#.#72.128.127/ping.php?su#########
- http://18#.#72.128.109/BroomSetup.exe
HTTP POST requests
- http://se####ation17io.io/index.php
UDP
- DNS ASK se####ation17io.io
- DNS ASK tr##c.com
- DNS ASK ni###.bestsup.su
- DNS ASK c3##############2b-8909-b15b8bfad661.uuid.localstats.org
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
- ClassName: 'zd0a59_Flash342FixClass_zd0a59' WindowName: ''
- ClassName: 'msctls_updown32' WindowName: ''
Creates and executes the following
- '%TEMP%\3562.exe'
- '%LOCALAPPDATA%\mail box stat view\mailboxstatview.exe' -s
- '%APPDATA%\hwrfsbc'
- '%TEMP%\csrss\patch.exe'
- '%TEMP%\u1b8.1.exe'
- '%TEMP%\bf40.exe'
- '%TEMP%\u1b8.0.exe'
- '%TEMP%\288c47bbc1871b439df19ff4df68f076.exe'
- '%WINDIR%\rss\csrss.exe'
- '%LOCALAPPDATA%\mail box stat view\mailboxstatview.exe' -i
- '%TEMP%\9ace.exe'
- '%TEMP%\is-hgdmd.tmp\94d4.tmp' /SL5="$10258,1649107,56832,%TEMP%\94D4.exe"
- '%TEMP%\94d4.exe'
- '%TEMP%\8e8d.exe'
- '%TEMP%\installsetup_four.exe'
- '%TEMP%\6347.exe'
- '%TEMP%\567a.exe'
- '<SYSTEM32>\schtasks.exe' /delete /tn ScheduledUpdate /f' (with hidden window)
- '<SYSTEM32>\bcdedit.exe' /v' (with hidden window)
- '%TEMP%\csrss\injector\injector.exe' taskmgr.exe %TEMP%\csrss\injector\NtQuerySystemInformationHook.dll' (with hidden window)
- '%TEMP%\csrss\patch.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\Temp\Task.bat" "' (with hidden window)
- '%WINDIR%\rss\csrss.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes"' (with hidden window)
- '%WINDIR%\windefender.exe' ' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /CREATE /SC ONLOGON /RL HIGHEST /TR "%WINDIR%\rss\csrss.exe" /TN csrss /F' (with hidden window)
- '%APPDATA%\hwrfsbc' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)' (with hidden window)
Executes the following
- '<SYSTEM32>\regsvr32.exe' /s %TEMP%\420F.dll
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\Temp\Task.bat" "
- '%WINDIR%\syswow64\chcp.com' 1251
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "MalayamaraUpdate" /tr "'%TEMP%\Updater.exe'" /sc minute /mo 30 /F
- '<SYSTEM32>\cmd.exe' /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes"
- '<SYSTEM32>\schtasks.exe' /CREATE /SC ONLOGON /RL HIGHEST /TR "%WINDIR%\rss\csrss.exe" /TN csrss /F
- '<SYSTEM32>\schtasks.exe' /delete /tn ScheduledUpdate /f
- '<SYSTEM32>\taskeng.exe' {E8902451-B98A-4521-9ABE-7C913CF4304C} S-1-5-21-3150914307-1777937420-491476919-1000:iejeely\user:Interactive:[1]
- '<SYSTEM32>\bcdedit.exe' /v
- '%WINDIR%\syswow64\cmd.exe' /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
- '%WINDIR%\syswow64\sc.exe' sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
