Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Runonce] 'cmdrun' = 'cmd.exe /C ipconfig /flushdns'
Substitutes the following executable system files
- <SYSTEM32>\dnsapi.dll with <SYSTEM32>\dnsapi.dll
- %WINDIR%\SysWOW64\dnsapi.dll with %WINDIR%\syswow64\dnsapi.dll
Infects the following executable files
- <SYSTEM32>\dnsapi.dll
- %WINDIR%\syswow64\dnsapi.dll
Malicious functions
To complicate detection of its presence in the operating system,
modifies the following system settings:
- DNS server to '104.197.191.4'
Modifies file system
Creates the following files
- %TEMP%\nsabc8b.tmp
- %APPDATA%\bomowafecn\jitpi.exe
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\ssl3.dll
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\sqlite3.dll
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\softokn3.dll
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\smime3.dll
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\nssutil3.dll
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\nssdbm3.dll
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\nssckbi.dll
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\nss3.dll
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\libplds4.dll
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\libplc4.dll
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\libnspr4.dll
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\freebl3.dll
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\sygloohejqub.dat
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\havqipyshu.exe
- %TEMP%\nsvbd09.tmp\stdutils.dll
- %TEMP%\nsvbd09.tmp\system.dll
- %APPDATA%\bomowafecn\mopogews.din
- <SYSTEM32>\def\fosd\taqe.dat
Deletes the following files
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\freebl3.dll
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\havqipyshu.exe
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\libnspr4.dll
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\libplc4.dll
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\libplds4.dll
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\nss3.dll
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\nssckbi.dll
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\nssdbm3.dll
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\nssutil3.dll
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\smime3.dll
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\softokn3.dll
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\sqlite3.dll
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\ssl3.dll
- %LOCALAPPDATA%\tempfolder\nesekcuimpim\sygloohejqub.dat
- %TEMP%\nsvbd09.tmp\stdutils.dll
- %TEMP%\nsvbd09.tmp\system.dll
Moves the following system files
- from <SYSTEM32>\dnsapi.dll to %TEMP%\ds23452.bin
- from %WINDIR%\syswow64\dnsapi.dll to %TEMP%\ds23179.bin
Network activity
TCP
Other
- '34.##9.100.209':443
Miscellaneous
Adds a root certificate
Creates and executes the following
- '%LOCALAPPDATA%\tempfolder\nesekcuimpim\havqipyshu.exe' spa="%APPDATA%\BomowaFecn\Jitpi.exe"
Executes the following
- '<SYSTEM32>\ipconfig.exe' /renew
- '<SYSTEM32>\ipconfig.exe' /renew' (with hidden window)
