Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
- [<HKLM>\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
- [<HKLM>\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
- [<HKLM>\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
- [<HKLM>\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
Modifies file system
Creates the following files
- C:\esp.dll
- %WINDIR%\syswow64\espi11.dll
Moves the following system files
- from <DRIVERS>\etc\hosts to %TEMP%\479110\....\caonimabi.exe
Substitutes the following files
- <DRIVERS>\etc\hosts
Substitutes the HOSTS file.
Network activity
Connects to
- '82##g.com':80
UDP
- DNS ASK 82##g.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p everyone:F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p system:F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p administrator:F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p administrators:F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p Users:F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p guests:F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p replicator:F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p IIS_iusrs:F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p everyone:R' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p system:R' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p administrator:R' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p administrators:R' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p Users:R' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p guests:R' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p replicator:R' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p IIS_iusrs:R' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p everyone:F
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p IIS_iusrs:R
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p replicator:R
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p guests:R
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p Users:R
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p administrators:R
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p system:R
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p IIS_iusrs:R
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p replicator:R
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p guests:R
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p Users:R
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p administrators:R
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p administrator:R
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p system:R
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p everyone:R
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p everyone:F
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p administrator:F
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p IIS_iusrs:F
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p replicator:F
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p guests:F
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p Users:F
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p system:F
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p administrators:F
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p IIS_iusrs:F
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p replicator:F
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p guests:F
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p Users:F
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p administrators:F
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p administrator:F
- '%WINDIR%\syswow64\cmd.exe' /c cacls.exe <DRIVERS>\etc\hosts /e /t /p system:F
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p administrator:R
- '%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /e /t /p everyone:R
