Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '11f86284' = '%APPDATA%\WinSys\coresys.exe'
Malicious functions
Injects code into
the following user processes:
- xcoresys.exe
Modifies file system
Creates the following files
- %APPDATA%\winsys\coresys.exe
- %APPDATA%\winsys\xcoresys.exe
- %APPDATA%\winsys\log.dat
Network activity
TCP
HTTP GET requests
- http://www.ka####rather.com/wp-content/plugins/WPSecurity/load.php
HTTP POST requests
- http://www.se#####eachvilla.com/wp-content/plugins/WPSecurity/load.php
- http://www.wp###.me-store.com/wp-content/plugins/WPSecurity/load.php
- http://ai####blication.com/wp-content/plugins/WPSecurity/load.php
- http://ap##epen.vn/wp-content/plugins/WPSecurity/load.php
- http://sh####t.tara.co.il/wp-content/plugins/WPSecurity/load.php
- http://bl#####ich.danang.vip/wp-content/plugins/WPSecurity/load.php
- http://www.ag###expert.ro/wp-content/plugins/WPSecurity/load.php
- http://ne####tprints.com/wp-content/plugins/WPSecurity/load.php
- http://li###pg.edu.mx/wp-content/plugins/WPSecurity/load.php
- http://so###oday.com/wp-content/plugins/WPSecurity/load.php
- http://www.be#####utiquegift.com/wp-content/plugins/WPSecurity/load.php
- http://www.st######constructions.com/wp-content/plugins/WPSecurity/load.php
- http://www.en###ations.com/wp-content/plugins/WPSecurity/load.php
- http://ka####rather.com/wp-content/plugins/WPSecurity/load.php
- http://www.rd#####etingdigital.com/wp-content/plugins/WPSecurity/load.php
UDP
- DNS ASK google.com
- DNS ASK en###ations.com
- DNS ASK st######constructions.com
- DNS ASK mi##o.ga
- DNS ASK ob##3.com
- DNS ASK be#####utiquegift.com
- DNS ASK so###oday.com
- DNS ASK li###pg.edu.mx
- DNS ASK de#####llo2.121mk.com
- DNS ASK ka####rather.com
- DNS ASK ne####tprints.com
- DNS ASK ag###expert.ro
- DNS ASK bl#####ich.danang.vip
- DNS ASK sh####t.tara.co.il
- DNS ASK al####ismail.com
- DNS ASK ap##epen.vn
- DNS ASK ai####blication.com
- DNS ASK wp###.me-store.com
- DNS ASK se#####eachvilla.com
- DNS ASK se#####ammithali.com
- DNS ASK rd#####etingdigital.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\winsys\coresys.exe'
- '%APPDATA%\winsys\xcoresys.exe' --CLIPS
- '%APPDATA%\winsys\xcoresys.exe' --CLIPSS
- '%APPDATA%\winsys\xcoresys.exe' --WALLS
- '%APPDATA%\winsys\xcoresys.exe' --PARSE
- '<SYSTEM32>\cmd.exe' /c type "<Full path to file>" > "%APPDATA%\WinSys\coresys.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c type "<Full path to file>" > "%APPDATA%\WinSys\xcoresys.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c pushd %APPDATA%\WinSys & start coresys.exe & popd' (with hidden window)
- '%APPDATA%\winsys\xcoresys.exe' --CLIPS' (with hidden window)
- '%APPDATA%\winsys\xcoresys.exe' --CLIPSS' (with hidden window)
- '%APPDATA%\winsys\xcoresys.exe' --WALLS' (with hidden window)
- '%APPDATA%\winsys\xcoresys.exe' --PARSE' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c type "<Full path to file>" > "%APPDATA%\WinSys\coresys.exe"
- '<SYSTEM32>\cmd.exe' /c type "<Full path to file>" > "%APPDATA%\WinSys\xcoresys.exe"
- '<SYSTEM32>\cmd.exe' /c pushd %APPDATA%\WinSys & start coresys.exe & popd
