Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Host' = '%ALLUSERSPROFILE%\Windows Host\Windows Host.exe'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /im 427269.exe /f
Injects code into
the following user processes:
- 427269.exe
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\427269.exe
- %ALLUSERSPROFILE%\gpfdw8d2omaeqhl1e60expt6j\files\information.txt
- %ALLUSERSPROFILE%\gpfdw8d2omaeqhl1e60expt6j\files\cookie_list.txt
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %ALLUSERSPROFILE%\gpfdw8d2omaeqhl1e60expt6j\wd
- %ALLUSERSPROFILE%\gpfdw8d2omaeqhl1e60expt6j\historych
- %ALLUSERSPROFILE%\gpfdw8d2omaeqhl1e60expt6j\ld
- %ALLUSERSPROFILE%\gpfdw8d2omaeqhl1e60expt6j\files\history\history_mozilla firefox_gn7ryp3k.default.txt
- %ALLUSERSPROFILE%\gpfdw8d2omaeqhl1e60expt6j\history-shm
- %ALLUSERSPROFILE%\gpfdw8d2omaeqhl1e60expt6j\history
- %ALLUSERSPROFILE%\gpfdw8d2omaeqhl1e60expt6j\files\cookies\cookies_mozilla firefox_gn7ryp3k.default.txt
- %ALLUSERSPROFILE%\gpfdw8d2omaeqhl1e60expt6j\c-shm
- %ALLUSERSPROFILE%\gpfdw8d2omaeqhl1e60expt6j\c
- %ALLUSERSPROFILE%\vcruntime140.dll
- %ALLUSERSPROFILE%\softokn3.dll
- %ALLUSERSPROFILE%\nss3.dll
- %ALLUSERSPROFILE%\msvcp140.dll
- %ALLUSERSPROFILE%\mozglue.dll
- %ALLUSERSPROFILE%\freebl3.dll
- %ALLUSERSPROFILE%\windows host\windows host.exe
- %ALLUSERSPROFILE%\970860.bat
- %ALLUSERSPROFILE%\970860.exe
- %ALLUSERSPROFILE%\622453.bat
- %ALLUSERSPROFILE%\gpfdw8d2omaeqhl1e60expt6j\files\files\default.zip
- %ALLUSERSPROFILE%\gpfdw8d2omaeqhl1e60expt6j\nl_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee3814298382.zip
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\windows host\windows host.exe
Deletes the following files
- %ALLUSERSPROFILE%\gpfdw8d2omaeqhl1e60expt6j\c-shm
- %ALLUSERSPROFILE%\gpfdw8d2omaeqhl1e60expt6j\history-shm
- %ALLUSERSPROFILE%\gpfdw8d2omaeqhl1e60expt6j\files\cookies\cookies_mozilla firefox_gn7ryp3k.default.txt
- %ALLUSERSPROFILE%\gpfdw8d2omaeqhl1e60expt6j\files\cookie_list.txt
- %ALLUSERSPROFILE%\gpfdw8d2omaeqhl1e60expt6j\files\files\default.zip
- %ALLUSERSPROFILE%\gpfdw8d2omaeqhl1e60expt6j\files\history\history_mozilla firefox_gn7ryp3k.default.txt
- %ALLUSERSPROFILE%\gpfdw8d2omaeqhl1e60expt6j\files\information.txt
- %ALLUSERSPROFILE%\gpfdw8d2omaeqhl1e60expt6j\nl_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee3814298382.zip
- %ALLUSERSPROFILE%\427269.exe
Network activity
Connects to
- 'ip##pi.com':80
TCP
HTTP GET requests
- http://re####booking.ac.ug/mozglue.dll
- http://re####booking.ac.ug/msvcp140.dll
- http://re####booking.ac.ug/nss3.dll
- http://re####booking.ac.ug/softokn3.dll
- http://re####booking.ac.ug/vcruntime140.dll
- http://re####booking.ac.ug/freebl3.dll
UDP
- DNS ASK tr#####-solutions.xyz
- DNS ASK ip###ger.org
- DNS ASK re####booking.ac.ug
- DNS ASK ip##pi.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%ALLUSERSPROFILE%\427269.exe'
- '%ALLUSERSPROFILE%\970860.exe'
- '%ALLUSERSPROFILE%\windows host\windows host.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\622453.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\970860.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im 427269.exe /f & erase %ALLUSERSPROFILE%\427269.exe & exit' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\622453.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\970860.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im 427269.exe /f & erase %ALLUSERSPROFILE%\427269.exe & exit
