Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Host' = '%ALLUSERSPROFILE%\Windows Host\Windows Host.exe'
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\188433.2
- %ALLUSERSPROFILE%\4955004.54
- %ALLUSERSPROFILE%\windows host\windows host.exe
- %ALLUSERSPROFILE%\6375
- %ALLUSERSPROFILE%\63\softokn3.dll
- %ALLUSERSPROFILE%\63\sqlite3.dll
- %ALLUSERSPROFILE%\63\vcruntime140.dll
- %ALLUSERSPROFILE%\63\freebl3.dll
- %ALLUSERSPROFILE%\63\mozglue.dll
- %ALLUSERSPROFILE%\63\msvcp140.dll
- %ALLUSERSPROFILE%\63\nss3.dll
- %ALLUSERSPROFILE%\63\b39b9b55c2f712bdd2b6d157de9b975a.txt
- %ALLUSERSPROFILE%\63\34c5661dd9392f4d604ed306b427a76c.txt
- %ALLUSERSPROFILE%\63\c093ff08693153600996bed9bb627d62.txt
- %ALLUSERSPROFILE%\63\7db3d03ce97404b29e05ac552a16d25f.txt
- %ALLUSERSPROFILE%\63\67672a58e3d690aa039745f2e65844cc.txt
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\windows host\windows host.exe
Deletes the following files
- %ALLUSERSPROFILE%\63\34c5661dd9392f4d604ed306b427a76c.txt
- %ALLUSERSPROFILE%\63\67672a58e3d690aa039745f2e65844cc.txt
- %ALLUSERSPROFILE%\63\7db3d03ce97404b29e05ac552a16d25f.txt
- %ALLUSERSPROFILE%\63\b39b9b55c2f712bdd2b6d157de9b975a.txt
- %ALLUSERSPROFILE%\63\c093ff08693153600996bed9bb627d62.txt
- %ALLUSERSPROFILE%\63\freebl3.dll
- %ALLUSERSPROFILE%\63\mozglue.dll
- %ALLUSERSPROFILE%\63\msvcp140.dll
- %ALLUSERSPROFILE%\63\nss3.dll
- %ALLUSERSPROFILE%\63\softokn3.dll
- %ALLUSERSPROFILE%\63\sqlite3.dll
- %ALLUSERSPROFILE%\63\vcruntime140.dll
- %ALLUSERSPROFILE%\6375
Network activity
Connects to
- 'mi####dollars.xyz':443
- 'ip###ger.org':443
- 'microsoft.com':80
- 'st###hammer.xyz':443
TCP
- 'mi####dollars.xyz':443
- 'ip###ger.org':443
- 'st###hammer.xyz':443
UDP
- DNS ASK mi####dollars.xyz
- DNS ASK ip###ger.org
- DNS ASK microsoft.com
- DNS ASK st###hammer.xyz
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\188433.2'
- '%ALLUSERSPROFILE%\4955004.54'
- '%ALLUSERSPROFILE%\windows host\windows host.exe'
