Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WinHost' = '%APPDATA%\WinHost\WinHoster.exe'
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %APPDATA%\7291764.exe
- %TEMP%\tmp3e85.tmp
- %TEMP%\tmp3e75.tmp
- %TEMP%\tmp3e74.tmp
- %TEMP%\tmp3e73.tmp
- %TEMP%\tmp3e72.tmp
- %TEMP%\tmp3e87.tmp
- %TEMP%\tmp3e61.tmp
- %TEMP%\tmp3e5f.tmp
- %TEMP%\tmp3e4f.tmp
- %TEMP%\tmp3e4e.tmp
- %TEMP%\tmp3e4d.tmp
- %TEMP%\tmp3e4c.tmp
- %TEMP%\tmp3e4b.tmp
- %TEMP%\tmp3e60.tmp
- %TEMP%\tmp3df1.tmp
- %TEMP%\tmp3ea8.tmp
- %TEMP%\tmp3ef5.tmp
- %TEMP%\tmp3ef4.tmp
- %TEMP%\tmp3ee3.tmp
- %TEMP%\tmp3ed3.tmp
- %TEMP%\tmp3ed2.tmp
- %TEMP%\tmp3ed1.tmp
- %TEMP%\tmp3e3a.tmp
- %TEMP%\tmp3e86.tmp
- %TEMP%\tmp3ece.tmp
- %TEMP%\tmp3ebd.tmp
- %TEMP%\tmp3ebc.tmp
- %TEMP%\tmp3ebb.tmp
- %TEMP%\tmp3eba.tmp
- %TEMP%\tmp3eb9.tmp
- %TEMP%\tmp3ecf.tmp
- %TEMP%\tmp3ea9.tmp
- %TEMP%\tmp3e39.tmp
- %TEMP%\tmp3e38.tmp
- %TEMP%\tmp3e27.tmp
- %ALLUSERSPROFILE%\50\vcruntime140.dll
- %APPDATA%\2528083.exe
- %APPDATA%\3199309.exe
- %APPDATA%\winhost\winhoster.exe
- %ALLUSERSPROFILE%\5056
- %ALLUSERSPROFILE%\50\softokn3.dll
- %TEMP%\tmp3f15.tmp
- %ALLUSERSPROFILE%\50\sqlite3.dll
- %ALLUSERSPROFILE%\50\c18ac74c6792e9ab593f6df284ba4486.txt
- %ALLUSERSPROFILE%\50\mozglue.dll
- %ALLUSERSPROFILE%\50\msvcp140.dll
- %ALLUSERSPROFILE%\50\nss3.dll
- %ALLUSERSPROFILE%\50\5c71f3d09560bdd444cfa54c78631195.txt
- %ALLUSERSPROFILE%\50\fb935fba6cafc2cc860b8fc4f7327992.txt
- %ALLUSERSPROFILE%\50\freebl3.dll
- %TEMP%\tmp3ed0.tmp
- %ALLUSERSPROFILE%\50\a5b45e656c141e7b600da4315efd9390.txt
- %TEMP%\tmp3dbc.tmp
- %ALLUSERSPROFILE%\50\75c81421514dc01bac61a02061794af0.txt
- %TEMP%\tmp3e26.tmp
- %TEMP%\tmp3e25.tmp
- %TEMP%\tmp3e24.tmp
- %TEMP%\tmp3e14.tmp
- %TEMP%\tmp3e13.tmp
- %TEMP%\tmp3dab.tmp
- %TEMP%\tmp3e02.tmp
- %ALLUSERSPROFILE%\50\3b611823b9bbf6b99943eb311e39b5cb.txt
- %TEMP%\tmp3df0.tmp
- %TEMP%\tmp3ddf.tmp
- %TEMP%\tmp3dde.tmp
- %TEMP%\tmp3dcd.tmp
- %TEMP%\tmp3dcc.tmp
- %TEMP%\tmp3e01.tmp
- %TEMP%\tmp3f16.tmp
Sets the 'hidden' attribute to the following files
- %APPDATA%\winhost\winhoster.exe
Deletes the following files
- %ALLUSERSPROFILE%\50\3b611823b9bbf6b99943eb311e39b5cb.txt
- %TEMP%\tmp3e4f.tmp
- %TEMP%\tmp3e4e.tmp
- %TEMP%\tmp3e60.tmp
- %TEMP%\tmp3e5f.tmp
- %TEMP%\tmp3e72.tmp
- %TEMP%\tmp3e61.tmp
- %TEMP%\tmp3e74.tmp
- %TEMP%\tmp3e73.tmp
- %TEMP%\tmp3e85.tmp
- %TEMP%\tmp3e75.tmp
- %TEMP%\tmp3e87.tmp
- %TEMP%\tmp3e86.tmp
- %TEMP%\tmp3ea9.tmp
- %TEMP%\tmp3dcd.tmp
- %TEMP%\tmp3ea8.tmp
- %TEMP%\tmp3eb9.tmp
- %TEMP%\tmp3ebc.tmp
- %TEMP%\tmp3ebb.tmp
- %TEMP%\tmp3ece.tmp
- %TEMP%\tmp3ebd.tmp
- %TEMP%\tmp3ed0.tmp
- %TEMP%\tmp3ecf.tmp
- %TEMP%\tmp3ed2.tmp
- %TEMP%\tmp3ed1.tmp
- %TEMP%\tmp3ee3.tmp
- %TEMP%\tmp3ed3.tmp
- %TEMP%\tmp3ef5.tmp
- %TEMP%\tmp3ef4.tmp
- %TEMP%\tmp3e4d.tmp
- %TEMP%\tmp3e4c.tmp
- %TEMP%\tmp3e3a.tmp
- %TEMP%\tmp3e4b.tmp
- %TEMP%\tmp3e38.tmp
- %ALLUSERSPROFILE%\50\75c81421514dc01bac61a02061794af0.txt
- %ALLUSERSPROFILE%\50\a5b45e656c141e7b600da4315efd9390.txt
- %ALLUSERSPROFILE%\50\c18ac74c6792e9ab593f6df284ba4486.txt
- %ALLUSERSPROFILE%\50\fb935fba6cafc2cc860b8fc4f7327992.txt
- %ALLUSERSPROFILE%\50\freebl3.dll
- %ALLUSERSPROFILE%\50\mozglue.dll
- %ALLUSERSPROFILE%\50\msvcp140.dll
- %ALLUSERSPROFILE%\50\nss3.dll
- %ALLUSERSPROFILE%\50\softokn3.dll
- %ALLUSERSPROFILE%\50\sqlite3.dll
- %ALLUSERSPROFILE%\50\vcruntime140.dll
- %ALLUSERSPROFILE%\5056
- %TEMP%\tmp3dbc.tmp
- %TEMP%\tmp3f16.tmp
- %TEMP%\tmp3eba.tmp
- %TEMP%\tmp3dab.tmp
- %TEMP%\tmp3ddf.tmp
- %TEMP%\tmp3dde.tmp
- %TEMP%\tmp3df1.tmp
- %TEMP%\tmp3df0.tmp
- %TEMP%\tmp3e02.tmp
- %TEMP%\tmp3e01.tmp
- %TEMP%\tmp3e14.tmp
- %TEMP%\tmp3e13.tmp
- %TEMP%\tmp3e25.tmp
- %TEMP%\tmp3e24.tmp
- %TEMP%\tmp3e27.tmp
- %TEMP%\tmp3e26.tmp
- %TEMP%\tmp3e39.tmp
- %ALLUSERSPROFILE%\50\5c71f3d09560bdd444cfa54c78631195.txt
- %TEMP%\tmp3dcc.tmp
- %TEMP%\tmp3f15.tmp
Network activity
Connects to
- 'ip###ger.org':443
- 'microsoft.com':80
- 'ka###annne.xyz':80
- 'ap#.ip.sb':443
TCP
HTTP POST requests
- http://ka###annne.xyz/
Other
- 'vi######vert-download38.xyz':443
- 'ip###ger.org':443
- 'vi######vert-download12.xyz':443
- 'ap#.ip.sb':443
UDP
- DNS ASK vi######vert-download38.xyz
- DNS ASK ip###ger.org
- DNS ASK vi######vert-download12.xyz
- DNS ASK microsoft.com
- DNS ASK ka###annne.xyz
- DNS ASK ap#.ip.sb
Miscellaneous
Creates and executes the following
- '%APPDATA%\7291764.exe'
- '%APPDATA%\2528083.exe'
- '%APPDATA%\3199309.exe'
- '%APPDATA%\winhost\winhoster.exe'
- '%APPDATA%\7291764.exe' ' (with hidden window)
- '%APPDATA%\2528083.exe' ' (with hidden window)
- '%APPDATA%\3199309.exe' ' (with hidden window)
