Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '11f86284' = '%APPDATA%\WinSys\coresys.exe'
Modifies file system
Creates the following files
- %APPDATA%\winsys\coresys.exe
- %APPDATA%\winsys\xcoresys.exe
- %APPDATA%\winsys\log.dat
Network activity
TCP
HTTP POST requests
- http://ap###hoj.com/wp-content/plugins/WPSecurity/load.php
- http://se#####vertising.com/wp-content/plugins/WPSecurity/load.php
- http://pa####elangi.com/wp-content/plugins/WPSecurity/load.php
- http://mo##kniv.se/wp-content/plugins/WPSecurity/load.php
- http://dv###de.com.ua/wp-content/plugins/WPSecurity/load.php
- http://fi###tates.com/wp-content/plugins/WPSecurity/load.php
- http://www.ex###banks.com/wp-content/plugins/WPSecurity/load.php
- http://na###nator.com/wp-content/plugins/WPSecurity/load.php
- http://ar###c-mag.com/wp-content/plugins/WPSecurity/load.php
- http://pr######ssagesonhold.com/wp-content/plugins/WPSecurity/load.php
- http://www.te###ntak.com/wp-content/plugins/WPSecurity/load.php
- http://www.ra#z.ec/wp-content/plugins/WPSecurity/load.php
- http://ca###sgbedu.com/wp-content/plugins/WPSecurity/load.php
- http://fo####dfederal.com/wp-content/plugins/WPSecurity/load.php
- http://bd###s24.com/wp-content/plugins/WPSecurity/load.php
- http://www.st#####atchcenter.se/wp-content/plugins/WPSecurity/load.php
- http://ch###ahar.com/wp-content/plugins/WPSecurity/load.php
UDP
- DNS ASK ap###hoj.com
- DNS ASK na###nator.com
- DNS ASK se#####vertising.com
- DNS ASK pa####elangi.com
- DNS ASK mo##kniv.se
- DNS ASK dv###de.com.ua
- DNS ASK fi###tates.com
- DNS ASK ex###banks.com
- DNS ASK ar###c-mag.com
- DNS ASK la###tprice.pk
- DNS ASK st#####atchcenter.se
- DNS ASK pr######ssagesonhold.com
- DNS ASK bu#.org.ua
- DNS ASK te###ntak.com
- DNS ASK ra#z.ec
- DNS ASK ca###sgbedu.com
- DNS ASK fo####dfederal.com
- DNS ASK bd###s24.com
- DNS ASK sp####ngmyass.com
- DNS ASK ch###ahar.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\winsys\coresys.exe'
- '%APPDATA%\winsys\xcoresys.exe' --CLIPS
- '%APPDATA%\winsys\xcoresys.exe' --CLIPSS
- '%APPDATA%\winsys\xcoresys.exe' --WALLS
- '%APPDATA%\winsys\xcoresys.exe' --PARSE
- '<SYSTEM32>\cmd.exe' /c type "<Full path to file>" > "%APPDATA%\WinSys\coresys.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c type "<Full path to file>" > "%APPDATA%\WinSys\xcoresys.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c pushd %APPDATA%\WinSys & start coresys.exe & popd' (with hidden window)
- '%APPDATA%\winsys\xcoresys.exe' --CLIPS' (with hidden window)
- '%APPDATA%\winsys\xcoresys.exe' --CLIPSS' (with hidden window)
- '%APPDATA%\winsys\xcoresys.exe' --WALLS' (with hidden window)
- '%APPDATA%\winsys\xcoresys.exe' --PARSE' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c type "<Full path to file>" > "%APPDATA%\WinSys\coresys.exe"
- '<SYSTEM32>\cmd.exe' /c type "<Full path to file>" > "%APPDATA%\WinSys\xcoresys.exe"
- '<SYSTEM32>\cmd.exe' /c pushd %APPDATA%\WinSys & start coresys.exe & popd
