Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Host' = '%ALLUSERSPROFILE%\Windows Host\Windows Host.exe'
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\6345411.69
- %ALLUSERSPROFILE%\3588747.39
- %ALLUSERSPROFILE%\windows host\windows host.exe
- %ALLUSERSPROFILE%\5462
- %ALLUSERSPROFILE%\54\softokn3.dll
- %ALLUSERSPROFILE%\54\sqlite3.dll
- %ALLUSERSPROFILE%\54\vcruntime140.dll
- %ALLUSERSPROFILE%\54\freebl3.dll
- %ALLUSERSPROFILE%\54\mozglue.dll
- %ALLUSERSPROFILE%\54\msvcp140.dll
- %ALLUSERSPROFILE%\54\nss3.dll
- %ALLUSERSPROFILE%\54\575b08344a1cd43ebac9420b4a6fe2f6.txt
- %ALLUSERSPROFILE%\54\1498511f88cacb8c74063ed0eb41c674.txt
- %ALLUSERSPROFILE%\54\ca82245525c487409965434e772afbc5.txt
- %ALLUSERSPROFILE%\54\c3ca947dfea2eebb62c57c2de2d15fb4.txt
- %ALLUSERSPROFILE%\54\d849550f63963099468e62e154121106.txt
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\windows host\windows host.exe
Deletes the following files
- %ALLUSERSPROFILE%\54\1498511f88cacb8c74063ed0eb41c674.txt
- %ALLUSERSPROFILE%\54\575b08344a1cd43ebac9420b4a6fe2f6.txt
- %ALLUSERSPROFILE%\54\c3ca947dfea2eebb62c57c2de2d15fb4.txt
- %ALLUSERSPROFILE%\54\ca82245525c487409965434e772afbc5.txt
- %ALLUSERSPROFILE%\54\d849550f63963099468e62e154121106.txt
- %ALLUSERSPROFILE%\54\freebl3.dll
- %ALLUSERSPROFILE%\54\mozglue.dll
- %ALLUSERSPROFILE%\54\msvcp140.dll
- %ALLUSERSPROFILE%\54\nss3.dll
- %ALLUSERSPROFILE%\54\softokn3.dll
- %ALLUSERSPROFILE%\54\sqlite3.dll
- %ALLUSERSPROFILE%\54\vcruntime140.dll
- %ALLUSERSPROFILE%\5462
Network activity
Connects to
- 'cr#####solutions.xyz':443
- 'ip###ger.org':443
- 'st###hammer.xyz':443
- 'microsoft.com':80
TCP
- 'cr#####solutions.xyz':443
- 'ip###ger.org':443
- 'st###hammer.xyz':443
UDP
- DNS ASK cr#####solutions.xyz
- DNS ASK ip###ger.org
- DNS ASK st###hammer.xyz
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\6345411.69'
- '%ALLUSERSPROFILE%\3588747.39'
- '%ALLUSERSPROFILE%\windows host\windows host.exe'
