Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Host' = '%ALLUSERSPROFILE%\Windows Host\Windows Host.exe'
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\135120.exe
- %ALLUSERSPROFILE%\72\df0c9cfb7792f7f9f55e192fe4b7179b.txt
- %ALLUSERSPROFILE%\72\d6b2517f2ec49ddab4bf7261e21caba2.txt
- %ALLUSERSPROFILE%\72\e3b0f90d0609f4d56eca749403d8168b.txt
- %ALLUSERSPROFILE%\72\nss3.dll
- %ALLUSERSPROFILE%\72\msvcp140.dll
- %ALLUSERSPROFILE%\72\mozglue.dll
- %ALLUSERSPROFILE%\72\freebl3.dll
- %ALLUSERSPROFILE%\72\vcruntime140.dll
- %ALLUSERSPROFILE%\72\sqlite3.dll
- %ALLUSERSPROFILE%\72\softokn3.dll
- %ALLUSERSPROFILE%\7288
- %ALLUSERSPROFILE%\windows host\windows host.exe
- %ALLUSERSPROFILE%\147835.bat
- %ALLUSERSPROFILE%\147835.exe
- %ALLUSERSPROFILE%\135120.bat
- %ALLUSERSPROFILE%\72\2eed01eebe4c7ed579ad49cb9a70b70d.txt
- %ALLUSERSPROFILE%\72\db54f5005ae871d14e14693be6cf4d21.txt
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\windows host\windows host.exe
Deletes the following files
- %ALLUSERSPROFILE%\72\2eed01eebe4c7ed579ad49cb9a70b70d.txt
- %ALLUSERSPROFILE%\72\d6b2517f2ec49ddab4bf7261e21caba2.txt
- %ALLUSERSPROFILE%\72\db54f5005ae871d14e14693be6cf4d21.txt
- %ALLUSERSPROFILE%\72\df0c9cfb7792f7f9f55e192fe4b7179b.txt
- %ALLUSERSPROFILE%\72\e3b0f90d0609f4d56eca749403d8168b.txt
- %ALLUSERSPROFILE%\72\freebl3.dll
- %ALLUSERSPROFILE%\72\mozglue.dll
- %ALLUSERSPROFILE%\72\msvcp140.dll
- %ALLUSERSPROFILE%\72\nss3.dll
- %ALLUSERSPROFILE%\72\softokn3.dll
- %ALLUSERSPROFILE%\72\sqlite3.dll
- %ALLUSERSPROFILE%\72\vcruntime140.dll
- %ALLUSERSPROFILE%\7288
Network activity
TCP
HTTP GET requests
- http://g2##.xyz/api.php
- http://g2##.xyz/api.php?ge######
UDP
- DNS ASK jo###soft.xyz
- DNS ASK g2##.xyz
- DNS ASK ip###ger.org
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\135120.exe'
- '%ALLUSERSPROFILE%\147835.exe'
- '%ALLUSERSPROFILE%\windows host\windows host.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\135120.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\147835.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\135120.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\147835.bat" "
