Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'win32updates.exe' = '%APPDATA%\WindowsUpdates\win32updates.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsHostManager' = '"%APPDATA%\9273099.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsHostManager' = '"%APPDATA%\system\WindowsHostManager.exe"'
Creates or modifies the following files:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\WinInetDriver.url
Malicious functions:
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system:
Creates the following files:
- %TEMP%\aut1.tmp
- C:\Logins.zip
- C:\Logins\CC.txt
- C:\Logins\Cookie.txt
- C:\Logins\Logins.txt
- %ALLUSERSPROFILE%\Application Data\{ea356e-da94ca-7723-ac66121a7bef}\hostdl.exe
- %APPDATA%\WindowsUpdates\win32updates.exe
- %APPDATA%\2289896.exe
- %APPDATA%\8704428.exe
- %APPDATA%\9273099.exe
- %APPDATA%\system\WindowsHostManager.exe
- %APPDATA%\4636297.exe
- %APPDATA%\9549669.tmp
- %TEMP%\aut5.tmp
- %APPDATA%\6293931.tmp
- %TEMP%\aut4.tmp
- %APPDATA%\4153490.tmp
- %TEMP%\aut3.tmp
- %APPDATA%\2191464.tmp
- %TEMP%\aut2.tmp
- %APPDATA%\8822085.tmp
- %HOMEPATH%\Desktop\7102841cheat.exe
- %APPDATA%\WindowsHostManagerLogs\08-07-2018
Sets the 'hidden' attribute to the following files:
- %ALLUSERSPROFILE%\Application Data\{ea356e-da94ca-7723-ac66121a7bef}\hostdl.exe
- %APPDATA%\system\WindowsHostManager.exe
Deletes the following files:
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut3.tmp
- %TEMP%\aut4.tmp
- %TEMP%\aut5.tmp
- %APPDATA%\8822085.tmp
- %APPDATA%\2191464.tmp
- %APPDATA%\4153490.tmp
- %APPDATA%\6293931.tmp
- %APPDATA%\9549669.tmp
Network activity:
Connects to:
- 'ip##pi.com':80
- 'fr###eoip.net':80
- 'ar##ara.ml':80
- 'ap#.#pify.org':80
- 'ae####.myvnc.com':43786
- 'ae####.myvnc.com':43784
- 'ae####.myvnc.com':43782
- 'ae####.myvnc.com':43781
TCP:
HTTP GET requests:
- http://ip##pi.com/json/
- http://fr###eoip.net/xml/
- http://ap#.#pify.org/
UDP:
- DNS ASK ip##pi.com
- DNS ASK fr###eoip.net
- DNS ASK ar##ara.ml
- DNS ASK ap#.#pify.org
- DNS ASK ae####.myvnc.com
Miscellaneous:
Searches for the following windows:
- ClassName: '18467-41' WindowName: ''
Creates and executes the following:
- '%HOMEPATH%\Desktop\7102841cheat.exe'
- '%APPDATA%\4636297.exe'
- '%APPDATA%\9273099.exe'
- '%APPDATA%\8704428.exe'
- '%APPDATA%\2289896.exe'
- '%APPDATA%\WindowsUpdates\win32updates.exe'
- '%APPDATA%\system\WindowsHostManager.exe'
Executes the following:
- '<SYSTEM32>\schtasks.exe' /create /tn WinInetDriver /tr %ALLUSERSPROFILE%\Application Data\{ea356e-da94ca-7723-ac66121a7bef}\hostdl.exe /sc minute /F
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsHostManager" /sc ONLOGON /tr "%APPDATA%\9273099.exe" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WindowsHostManager" /sc ONLOGON /tr "%APPDATA%\system\WindowsHostManager.exe" /rl HIGHEST /f
