Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'CB5CF0B215562186886669' = '%APPDATA%\CB5CF0B215562186886669\CB5CF0B215562186886669.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Updates' = '%APPDATA%\Microsoft\Updates\svchost.vbs'
Changes the following executable system files
- %WINDIR%\syswow64\dllhost.exe
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
the following user processes:
- cb5cf0b215562186886669.exe
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
Modifies file system
Creates the following files
- %TEMP%\cb5cf0b215562186886669
- %APPDATA%\microsoft\updates\svchost.vbs
- %APPDATA%\microsoft\updates\start.vbs
- %APPDATA%\microsoft\updates\start.bat
- %APPDATA%\microsoft\updates\setup.bat
- %APPDATA%\microsoft\updates\opencl.dll
- %APPDATA%\microsoft\updates\nvrtc64_92.dll
- %APPDATA%\microsoft\updates\nvrtc-builtins64_92.dll
- %APPDATA%\microsoft\updates\msvcp140.dll
- %APPDATA%\microsoft\updates\install.vbs
- %TEMP%\rarsfx0\vcruntime140.dll
- %TEMP%\rarsfx0\updates.exe
- %APPDATA%\microsoft\updates\updates.exe
- %TEMP%\rarsfx0\svchost.vbs
- %TEMP%\rarsfx0\start.bat
- %TEMP%\rarsfx0\setup.bat
- %TEMP%\rarsfx0\opencl.dll
- %TEMP%\rarsfx0\nvrtc-builtins64_92.dll
- %TEMP%\rarsfx0\nvrtc64_92.dll
- %TEMP%\rarsfx0\msvcp140.dll
- %TEMP%\rarsfx0\install.vbs
- %TEMP%\31cb.tmp.chromium.exe
- %TEMP%\cb5cf0b21556218688666964
- %TEMP%\cb5cf0b21556218688666932
- %APPDATA%\cb5cf0b215562186886669\cb5cf0b215562186886669.exe
- %TEMP%\rarsfx0\start.vbs
- %APPDATA%\microsoft\updates\vcruntime140.dll
Deletes the following files
- %TEMP%\cb5cf0b215562186886669
- %TEMP%\rarsfx0\install.vbs
- %TEMP%\rarsfx0\msvcp140.dll
- %TEMP%\rarsfx0\nvrtc-builtins64_92.dll
- %TEMP%\rarsfx0\nvrtc64_92.dll
- %TEMP%\rarsfx0\opencl.dll
- %TEMP%\rarsfx0\start.bat
- %TEMP%\rarsfx0\start.vbs
- %TEMP%\rarsfx0\svchost.vbs
- %TEMP%\rarsfx0\updates.exe
- %TEMP%\rarsfx0\vcruntime140.dll
Deletes itself.
Network activity
Connects to
- 'mi###gate.com':443
TCP
HTTP GET requests
- http://f0####43.xsph.ru/u5m2b9v/chromium.exe
HTTP POST requests
- http://62.##3.117.136/client.php?CB####################
UDP
- DNS ASK f0####43.xsph.ru
- DNS ASK mi###gate.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%APPDATA%\cb5cf0b215562186886669\cb5cf0b215562186886669.exe'
- '%TEMP%\31cb.tmp.chromium.exe'
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\RarSFX0\install.vbs"
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\Microsoft\Updates\svchost.vbs"
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\Microsoft\Updates\start.vbs"
- '%APPDATA%\microsoft\updates\updates.exe' --user 0xPh0enix@protonmail.com --xmr 2
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\setup.bat" "' (with hidden window)
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\Microsoft\Updates\start.vbs"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\Microsoft\Updates\start.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\start.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\dllhost.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\setup.bat" "
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Updates" /t REG_SZ /d ""%APPDATA%"\Microsoft\Updates\svchost.vbs" /f
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\Microsoft\Updates\start.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\start.bat" "
