Technical Information
Malicious functions
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:49164;https=127.0.0.1:49164;socks=127.0.0.1:49163'
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '<local>'
Modifies file system
Creates the following files
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\main[1]
- %APPDATA%\microsoft\windows\cookies\user@whatismyip[1].txt
- %APPDATA%\microsoft\windows\cookies\user@ipfounder[2].txt
- %APPDATA%\microsoft\windows\cookies\user@ipfounder[1].txt
- %APPDATA%\psiphon3\psiphon3.exe.upgrade.144.part
- %APPDATA%\psiphon3\psiphon3.exe.upgrade.144.part.etag
- <LS_APPDATA>\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\3cfgm8vf\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\xx6fb2ab\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\93vn3jhe\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\2hs1vk42\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- <LS_APPDATA>\microsoft\windows\history\low\history.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\logo[1]
- %APPDATA%\psiphon3\psiphon.boltdb
- %TEMP%\psiphon-tunnel-core.exe
- %APPDATA%\psiphon3\server_list.dat
- %APPDATA%\psiphon3\psiphon.config
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\flag_unknown_32[1]
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\banner[1]
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\flags32[1]
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\logo-bw[1]
- %TEMP%\dat8a55.tmp
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\icomoon[1]
- %APPDATA%\microsoft\windows\cookies\user@whatismyip[2].txt
- <LS_APPDATA>\microsoft\windows\history\history.ie5\mshist012019071820190719\index.dat
Sets the 'hidden' attribute to the following files
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\2hs1vk42\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\93vn3jhe\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\xx6fb2ab\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\3cfgm8vf\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\history.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\desktop.ini
Deletes the following files
- %APPDATA%\microsoft\windows\cookies\user@ipfounder[1].txt
- %APPDATA%\microsoft\windows\cookies\user@whatismyip[1].txt
- %APPDATA%\microsoft\windows\cookies\user@whatismyip[2].txt
- %APPDATA%\psiphon3\psiphon3.exe.upgrade.144.part.etag
Moves the following files
- from %APPDATA%\psiphon3\psiphon3.exe.upgrade.144.part to %APPDATA%\psiphon3\psiphon3.exe.upgrade.144
- from %APPDATA%\psiphon3\psiphon3.exe.upgrade.144 to %APPDATA%\psiphon3\psiphon3.exe.upgrade
Substitutes the following executable files
- <Full path to file>
Substitutes the following files
- %APPDATA%\microsoft\windows\cookies\user@whatismyip[1].txt
- %APPDATA%\microsoft\windows\cookies\user@whatismyip[2].txt
Moves itself
- from <Full path to file> to <Full path to file>.orig
Network activity
Connects to
- 'localhost':49164
TCP
HTTP GET requests
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/02FAF3E291435468607857694DF5E45B68851868.crt
- http://wh###smyip.li/psiphon1
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D
- http://oc##.#odaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
- http://oc##.#odaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D
- http://oc##.#odaddy.com//MEgwRjBEMEIwQDAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CBwQLre%2BWcn4%3D
HTTP POST requests
- http://www.cr####readho.com/
UDP
- DNS ASK a9##.#.akamai.net
- DNS ASK a6##.#.akamai.net
- DNS ASK a7##.#.akamai.net
Miscellaneous
Searches for the following windows
- ClassName: 'Internet Explorer_Server' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'Static' WindowName: ''
Creates and executes the following
- '%TEMP%\psiphon-tunnel-core.exe' --config "%APPDATA%\Psiphon3\psiphon.config" --serverList "%APPDATA%\Psiphon3\server_list.dat"
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' https://ipfounder.net/?sponsor_id=4BA4DEF917101460&sponsor=psiphon_bbg&client_region=NL&client_platform=windows&secret=580EfjEI29xL3hoyU6dgP4vSEVxdcGI7JDFkxgjds7PHulSEF0wmORpvzbqxyTwYtpowsY4xMF...
