Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\taskhost
- <SYSTEM32>\tasks\svchost
- <SYSTEM32>\tasks\winlogon
- <SYSTEM32>\tasks\dwm
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\smss
Modifies file system
Creates the following files
- C:\far2\plugins\network\taskhost.exe
- C:\far2\plugins\network\b75386f1303e64d8139363b71e44ac16341adf4e
- %TEMP%\8894e19ca9cb07ef0d000d04d143b04e.dat
- C:\documents and settings\svchost.exe
- C:\documents and settings\f4d236fdec2fd03914189c3b26e5cb0dfea9d761
- %ProgramFiles%\protect\winlogon.exe
- %ProgramFiles%\protect\cc11b995f2a76da408ea6a601e682e64743153ad
- C:\far2\encyclopedia\tap\dwm.exe
- C:\far2\encyclopedia\tap\6cb0b6c459d5d3455a3da700e713f2e2529862ff
- C:\far2\addons\csrss.exe
- C:\far2\addons\886983d96e3d3e31032c679b2d4ea91b6c05afef
- C:\totalcmd\language\smss.exe
- C:\totalcmd\language\69ddcba757bf72f7d36c464c71f42baab150b2b9
- C:\far2\encyclopedia\tap\taskhost.exe
- C:\far2\encyclopedia\tap\b75386f1303e64d8139363b71e44ac16341adf4e
Network activity
TCP
HTTP GET requests
- http://18#.#3.7.162/l3nioehqfsy0526a4u31pit8h2hsbpy/ye3gmsj3mqnd36hnt0mxchlbl7l5y4edx57n5uvg/94aad558672a9cc96bd860c8eb651c7542dee21f.php?d6#####################################################...
- http://18#.#3.7.162/l3nioehqfsy0526a4u31pit8h2hsbpy/ye3gmsj3mqnd36hnt0mxchlbl7l5y4edx57n5uvg/94aad558672a9cc96bd860c8eb651c7542dee21f.php?18#####################################################...
- http://18#.#3.7.162/l3nioehqfsy0526a4u31pit8h2hsbpy/ye3gmsj3mqnd36hnt0mxchlbl7l5y4edx57n5uvg/0pdbaa882xqscg/9b1b455ebd5cb4a80fb5b5fa997e3914.php?d2##############################################...
UDP
- DNS ASK ip##fo.io
Miscellaneous
Creates and executes the following
- 'C:\documents and settings\svchost.exe'
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'C:\Far2\Plugins\Network\taskhost.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "svchost" /sc ONLOGON /tr "'C:\Documents and Settings\svchost.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'%ProgramFiles%\protect\winlogon.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'C:\Far2\Encyclopedia\tap\dwm.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\Far2\Addons\csrss.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\smss.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'C:\Far2\Encyclopedia\tap\taskhost.exe'" /rl HIGHEST /f
