Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WinUpdater' = '<LS_APPDATA>\Packages\taskhostex.exe'
Modifies file system:
Creates the following files:
- <LS_APPDATA>\Packages\is-IT3QR.tmp
- <LS_APPDATA>\Packages\is-MKP17.tmp
- %TEMP%\is-2AQLG.tmp\<File name>.tmp
- %TEMP%\is-J93IJ.tmp\<File name>.tmp
Deletes the following files:
- %TEMP%\is-J93IJ.tmp\<File name>.tmp
- %TEMP%\is-2AQLG.tmp\<File name>.tmp
Moves the following files:
- from <LS_APPDATA>\Packages\is-MKP17.tmp to <LS_APPDATA>\Packages\taskhostex.exe.config
- from <LS_APPDATA>\Packages\is-IT3QR.tmp to <LS_APPDATA>\Packages\taskhostex.exe
Network activity:
Connects to:
- '18#.#5.48.68':80
- 'pa###bin.com':80
- '20#.#6.232.182':443
- 'wp#d':80
- 'ms#####.#ranus.feralhosting.com':80
- 'ms#####.##taeus.feralhosting.com':80
TCP:
HTTP GET requests:
- http://pa###bin.com/raw/Vf81BwHn
- http://pa###bin.com/raw/Z3mcNqjz
- http://pa###bin.com/raw/HNkipzLK
- http://pa###bin.com/raw/qdwMGvDS
- http://18#.#5.48.68/02ed55faea5d1d2b1490e78da30da107/zm.zip
- http://ms#####.##taeus.feralhosting.com/zm.zip
- http://pa###bin.com/raw/u66uXYRh
- http://ms#####.#ranus.feralhosting.com/zm.zip
- http://ms#####.#ranus.feralhosting.com/217eb54cfc0fe64e8a5d802042506b443
- http://ms#####.##taeus.feralhosting.com/6e628c7bd6d34dc3c2a8ae7d0e5a9b
- http://11#.#11.111.1/wpad.dat via wp#d
- http://ms#####.#ranus.feralhosting.com/68fead277b52bdd8f1ca21cddcd3299
- http://18#.#5.48.68/02ed55faea5d1d2b1490e78da30da107/fc324f595608bf3e9809c401917f9a6900977
- http://pa###bin.com/raw/h5yBCwpY
- http://ms#####.##taeus.feralhosting.com/c3cb5860f0dbf08b28efd5ab25ea95472e
- http://18#.#5.48.68/02ed55faea5d1d2b1490e78da30da107/5fc741325308c0e741e9509ed5d
UDP:
- DNS ASK pa###bin.com
- DNS ASK download.microsoft.com
- DNS ASK ms#####.##taeus.feralhosting.com
- DNS ASK wp#d
- DNS ASK ms#####.#ranus.feralhosting.com
Miscellaneous:
Creates and executes the following:
- '%TEMP%\is-J93IJ.tmp\<File name>.tmp' /SL5="$50036,302380,196608,<Full path to file>" /VERYSILENT /NORESTARTAPPLICATIONS /NOFORCECLOSEAPPLICATIONS /NOCLOSEAPPLICATIONS
- '<LS_APPDATA>\Packages\taskhostex.exe'
- '%TEMP%\is-2AQLG.tmp\<File name>.tmp' /SL5="$30092,302380,196608,<Full path to file>"
- '<Full path to file>' /VERYSILENT /NORESTARTAPPLICATIONS /NOFORCECLOSEAPPLICATIONS /NOCLOSEAPPLICATIONS
