Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Update' = '<LS_APPDATA>\Microsoft Windows\taskhost.exe'
Malicious functions:
Creates and executes the following:
- '<LS_APPDATA>\Microsoft Windows\taskhost.exe'
- '%TEMP%\is-CO2RU.tmp\<File name>.tmp' /SL5="$40092,525526,423424,<Full path to file>" /VERYSILENT /NORESTARTAPPLICATIONS /NOFORCECLOSEAPPLICATIONS /NOCLOSEAPPLICATIONS
- '%TEMP%\is-EJBK3.tmp\<File name>.tmp' /SL5="$40036,525526,423424,<Full path to file>"
Modifies file system:
Creates the following files:
- <LS_APPDATA>\Microsoft Windows\is-PJ3NE.tmp
- <LS_APPDATA>\Microsoft Windows\is-U2BG6.tmp
- %TEMP%\is-EJBK3.tmp\<File name>.tmp
- %TEMP%\is-CO2RU.tmp\<File name>.tmp
Deletes the following files:
- %TEMP%\is-CO2RU.tmp\<File name>.tmp
- %TEMP%\is-EJBK3.tmp\<File name>.tmp
Moves the following files:
- from <LS_APPDATA>\Microsoft Windows\is-U2BG6.tmp to <LS_APPDATA>\Microsoft Windows\taskhost.exe.config
- from <LS_APPDATA>\Microsoft Windows\is-PJ3NE.tmp to <LS_APPDATA>\Microsoft Windows\taskhost.exe
Network activity:
Connects to:
- '18#.#5.48.68':80
- 'pa###bin.com':80
- '20#.#6.232.182':443
- 'wp#d':80
- 'ms#####.#ranus.feralhosting.com':80
- 'ms#####.##taeus.feralhosting.com':80
TCP:
HTTP GET requests:
- http://pa###bin.com/raw/Vf81BwHn
- http://pa###bin.com/raw/Z3mcNqjz
- http://pa###bin.com/raw/HNkipzLK
- http://pa###bin.com/raw/qdwMGvDS
- http://18#.#5.48.68/02ed55faea5d1d2b1490e78da30da107/z126.zip
- http://ms#####.##taeus.feralhosting.com/z126.zip
- http://pa###bin.com/raw/u66uXYRh
- http://ms#####.#ranus.feralhosting.com/z126.zip
- http://ms#####.#ranus.feralhosting.com/217eb54cfc0fe64e8a5d802042506b443
- http://ms#####.##taeus.feralhosting.com/6e628c7bd6d34dc3c2a8ae7d0e5a9b
- http://11#.#11.111.1/wpad.dat via wp#d
- http://ms#####.#ranus.feralhosting.com/68fead277b52bdd8f1ca21cddcd3299
- http://18#.#5.48.68/02ed55faea5d1d2b1490e78da30da107/fc324f595608bf3e9809c401917f9a6900977
- http://pa###bin.com/raw/h5yBCwpY
- http://ms#####.##taeus.feralhosting.com/c3cb5860f0dbf08b28efd5ab25ea95472e
- http://18#.#5.48.68/02ed55faea5d1d2b1490e78da30da107/5fc741325308c0e741e9509ed5d
UDP:
- DNS ASK pa###bin.com
- DNS ASK download.microsoft.com
- DNS ASK ms#####.##taeus.feralhosting.com
- DNS ASK wp#d
- DNS ASK ms#####.#ranus.feralhosting.com
