Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Lantern' = '"%APPDATA%\Lantern\lantern.exe" -clear-proxy-settings'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Lantern' = '"%APPDATA%\Lantern\lantern.exe" -startup'
Malicious functions:
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = '127.0.0.1:1067'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '<local>'
- [<HKLM>\SYSTEM\ControlSet001\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
Modifies file system:
Creates the following files:
- %TEMP%\lantern-installer.exe
- %APPDATA%\Lantern\settings.yaml
- %APPDATA%\byteexec\sysproxy-cmd.exe
- %TEMP%\Tencentdl.exe
- %APPDATA%\systray\systray386.dll
- %APPDATA%\Lantern\logs\lantern.log
- %APPDATA%\byteexec\certimporter.exe
- %TEMP%\nsh2.tmp\ShellExecAsUser.dll
- %HOMEPATH%\Desktop\Lantern.lnk
- %HOMEPATH%\Start Menu\Programs\Lantern\Uninstall Lantern.lnk
- %HOMEPATH%\Start Menu\Programs\Lantern\Lantern.lnk
- %APPDATA%\Lantern\uninstall.exe
- %APPDATA%\Lantern\lantern.yaml
- %APPDATA%\Lantern\.packaged-lantern.yaml
- %APPDATA%\Lantern\lantern.ico
- %APPDATA%\Lantern\lantern.exe
- %TEMP%\notifu-notifier673178803\notifu.exe
- %APPDATA%\Lantern\proxystats.csv.tmp
Deletes the following files:
- %TEMP%\nsh2.tmp\ShellExecAsUser.dll
- <Full path to file>
Moves the following files:
- from %APPDATA%\Lantern\proxystats.csv.tmp to %APPDATA%\Lantern\proxystats.csv
Substitutes the following files:
- %APPDATA%\Lantern\proxystats.csv.tmp
Network activity:
Connects to:
- '12#.#25.114.144':80
- '54.##0.0.193':443
- '13.#2.4.205':443
- '54.##0.0.249':443
- '13.#2.4.227':443
- '13.#2.4.92':443
- '52.##.10.102':443
- '54.##2.20.58':443
- '54.##0.15.11':443
- '52.##.10.144':443
- '52.##2.132.210':443
- '54.##2.20.134':443
- '54.##0.15.239':443
- '54.##0.15.224':443
- '52.##2.132.118':443
- '52.##.10.114':443
- '13.##.16.167':443
- '54.##0.15.29':443
- '54.##2.20.153':443
- '52.#4.7.16':443
- '52.#4.7.50':443
- '13.##.20.145':443
- '52.##2.132.72':443
- '52.##2.136.120':443
- '13.##.20.228':443
- '13.#2.4.200':443
- '52.##2.132.83':443
- '54.#92.22.7':443
- '54.##2.22.41':443
- '52.##.10.109':443
- '54.##0.15.102':443
- '54.##0.7.248':443
- '13.#2.4.161':443
- '54.#82.2.96':443
- '52.##2.132.141':443
- '52.#4.7.226':443
- '54.##0.7.229':443
- '54.#82.2.47':443
- '52.#4.10.62':443
- '52.##2.136.92':443
- '52.#4.10.71':443
- '54.##2.20.20':443
- '54.##0.15.13':443
- '54.##0.15.235':443
- '54.#82.2.79':443
- '54.##0.7.108':443
- '52.##2.132.6':443
- '54.##2.2.193':443
- '52.##2.132.106':443
- '52.##2.132.221':443
- '52.##2.136.252':443
- '54.##2.22.104':443
- '13.#2.20.7':443
- '54.##2.20.213':443
- '54.##0.0.200':443
- '52.##.10.123':443
- '54.#30.7.75':443
- '54.##0.15.110':443
- '52.#4.7.134':443
- '52.##2.132.160':443
- '54.##2.2.228':443
- '54.#30.0.20':443
- '13.#2.20.78':443
- '13.#2.4.34':443
- '52.##2.136.7':443
- '54.##2.20.45':443
- '13.#2.4.174':443
- '52.##2.132.196':443
- '52.##2.136.199':443
- '54.##0.7.215':443
- '54.##2.22.151':443
- '54.##0.0.239':443
- '52.#4.10.8':443
- '54.##2.2.132':443
- '52.#4.10.41':443
- '13.##.16.200':443
- '54.##0.7.208':443
- '52.##2.132.131':443
- '54.##2.2.237':443
- '13.#2.20.20':443
- '13.#2.4.102':443
- '13.##.16.121':443
- '54.##0.0.244':443
- '52.#4.7.154':443
- '52.##.10.129':443
- '54.##0.7.218':443
- '13.##.16.196':443
- '13.##.20.243':443
- '52.##.10.184':443
- '13.##.20.193':443
- '52.#4.7.17':443
- '54.##0.0.149':443
- '52.##2.136.164':443
- '54.##2.20.219':443
- '13.#2.4.14':443
- '13.#2.4.86':443
- '54.##2.22.11':443
- '52.##2.136.160':443
- '54.##2.22.23':443
- '52.##2.132.199':443
- '13.#2.4.198':443
- '54.##2.2.196':443
- '52.#4.10.81':443
- '52.##2.132.37':443
- '54.##2.2.155':443
- '54.##0.0.164':443
- '54.##0.7.109':443
- '54.##2.22.177':443
- '54.#82.2.17':443
- '54.##2.2.204':443
- '54.#30.7.26':443
- '54.##2.22.253':443
- '13.##.16.141':443
- '52.##2.132.132':443
- '52.##2.136.159':443
- '13.##.20.247':443
- '54.##2.20.13':443
- '54.##2.22.113':443
- '52.##2.132.229':443
- '54.#92.20.9':443
- '54.##0.15.145':443
- '54.##2.20.100':443
- '54.##0.0.219':443
- '54.##2.22.148':443
- '54.##2.20.41':443
- '54.##0.0.163':443
- '54.##2.2.195':443
- '54.##2.22.101':443
- '54.##2.2.112':443
- '20#.#51.251.180':443
- '13.#2.20.25':443
- '52.##.10.166':443
- '13.##.16.214':443
- '13.#2.16.25':443
- '54.##2.2.179':443
- '54.##2.20.126':443
- '52.#4.7.91':443
- '54.##0.0.235':443
- '13.##.20.168':443
- '52.#4.10.66':443
- '13.#2.4.62':443
- '52.##2.136.176':443
- '52.##2.132.23':443
- '13.#2.20.39':443
- '54.##2.20.140':443
- '54.##2.20.162':443
- '54.#82.2.36':443
- '13.#2.4.146':443
- '52.#4.7.118':443
- '54.##2.22.216':443
- '54.#82.2.13':443
- '52.##.10.165':443
- '54.##2.2.248':443
- '52.##.10.214':443
- '54.##0.0.111':443
- '52.##2.132.174':443
- '52.##2.132.12':443
- '13.#2.4.144':443
- '54.##2.22.161':443
- '13.##.16.250':443
- '52.#4.7.237':443
- '52.##2.132.50':443
- '13.##.20.105':443
- '54.#30.0.91':443
- '54.##2.5.199':443
- '13.##.16.112':443
- '54.##2.22.159':443
- '54.##0.0.224':443
- '13.##.20.132':443
- '13.##.20.119':443
- '52.##.10.218':443
- '54.##2.20.164':443
- '13.#2.4.116':443
- '13.#2.20.50':443
- '54.##2.22.51':443
- '54.##2.20.212':443
- '54.##2.20.101':443
- '54.##2.20.185':443
- '54.##2.2.197':443
- '52.#4.10.95':443
- '52.#4.10.89':443
- '54.##2.22.117':443
- '52.##2.136.116':443
- '52.##2.132.230':443
- '54.##2.20.91':443
- '52.#4.7.191':443
- '54.##2.20.235':443
- '52.##.10.223':443
- '52.##2.132.73':443
- '13.##.16.249':443
- '54.##2.20.155':443
- '54.##0.15.61':443
- '52.##2.132.142':443
- '54.##0.0.167':443
- '54.##0.0.100':443
- '54.##2.22.190':443
- '13.##.20.177':443
- '54.##0.15.73':443
- '13.##.20.223':443
- '54.##0.0.229':443
- '13.##.16.140':443
- '54.##0.15.185':443
- '52.##.10.151':443
- '52.#4.7.69':443
- '52.##2.136.82':443
- '54.##0.0.143':443
- '54.##0.7.138':443
- '52.##.10.196':443
- '52.##.10.108':443
- '54.##2.2.130':443
- '13.#2.4.213':443
- '54.##0.15.221':443
- '10#.#1.223.217':13730
- 'ra#.####ubusercontent.com':443
- '54.#30.0.19':443
- '13.#2.16.44':443
- '52.##2.132.36':443
- '13.##.16.148':443
- '54.##2.20.28':443
- '54.##2.2.214':443
- '52.##2.136.72':443
- '54.##2.2.110':443
- '13.#2.4.239':443
- '54.##2.22.62':443
- '52.##2.136.198':443
- '45.##.178.100':13332
- '54.##2.20.39':443
- '54.##2.22.139':443
- '52.##2.136.80':443
- '13.#2.20.99':443
- '52.#4.7.113':443
- '54.##0.0.178':443
- '54.#30.0.10':443
- '54.##2.2.227':443
- '54.##0.0.127':443
- '13.#2.16.39':443
- '13.#2.4.201':443
- '52.##2.132.253':443
- '54.##2.20.92':443
- '52.##2.136.236':443
- '52.##2.136.151':443
- '13.#2.16.50':443
- '54.##2.20.136':443
- '13.##.20.188':443
- '52.##2.136.215':443
- '54.##0.0.113':443
- '52.##2.132.55':443
- '54.#30.0.65':443
- '13.#2.4.186':443
- '54.##0.15.94':443
- '13.##.20.171':443
- '52.##2.136.185':443
- '45.##.44.161':10489
- '52.##2.132.108':443
- '13.##.16.230':443
- '13.#2.16.42':443
- '52.##2.132.241':443
- '54.##0.0.222':443
- '13.##.20.151':443
- '52.##2.132.40':443
- '54.##2.22.156':443
- '54.##0.0.128':443
- '13.#2.4.143':443
- '52.##2.136.201':443
- '54.#82.2.72':443
- '54.#30.7.82':443
- '54.##2.2.177':443
- '54.##2.22.95':443
- 'ea########ownloads.adblockplus.org':443
- '52.##2.132.155':443
- '45.##.201.147':443
- '54.##2.22.90':443
- '54.##2.20.122':443
- '54.##0.7.222':443
- '54.##2.2.208':443
- '52.##2.132.79':443
- '52.##2.136.95':443
- '13.##.20.107':443
- '54.##2.22.168':443
- '52.##2.136.145':443
- '54.##2.2.176':443
- '54.##2.22.98':443
- 'pa#.abn.cc':443
- '54.#82.2.90':443
- '13.##.20.235':443
- '52.##.10.175':443
- '13.#2.4.30':443
- '52.##2.136.77':443
- '54.##0.7.153':443
- '54.##0.0.252':443
- '52.#4.10.17':443
- '45.#7.133.5':443
- '52.##2.132.16':443
- '13.#2.4.107':443
- 's3.###zonaws.com':443
- '54.##0.15.113':443
- '13.##.16.164':443
- '13.##.20.197':443
- '52.#4.7.206':443
- '52.##.10.199':443
- '52.##2.132.140':443
- '54.##2.20.60':443
- '13.#2.4.176':443
- '52.##.10.187':443
- '52.##2.132.107':443
- '54.##0.0.202':443
- '45.##.155.211':12983
- '54.##0.15.76':443
- 'localhost':1067
- '54.##2.22.91':443
- '54.##2.22.252':443
- '13.#2.16.99':443
- '13.#2.16.59':443
- '54.##0.15.30':443
- '54.##2.22.61':443
- '13.##.20.154':443
- '13.#2.4.130':443
- '54.#82.2.30':443
- '54.##2.22.86':443
- '54.##0.7.150':443
- '54.##2.22.224':443
- '54.##0.7.196':443
- '13.#2.4.212':443
- '54.#30.0.35':443
- '13.##.20.207':443
- '13.#2.4.159':443
- '52.#4.10.19':443
- '13.#2.16.93':443
- '54.##2.22.19':443
- '52.##2.132.226':443
- '13.##.20.124':443
- '52.##2.136.128':443
- '52.#4.7.201':443
- '54.##0.15.121':443
- '52.##.10.170':443
- '52.##2.132.202':443
- '54.##0.15.209':443
- '52.##2.132.145':443
- '54.##0.7.209':443
- '54.##2.22.50':443
- '13.#2.4.29':443
- '13.#2.20.49':443
- '54.##0.15.173':443
- '52.#4.7.98':443
- '52.##.10.155':443
- '13.##.16.245':443
- '13.#2.4.96':443
- '13.#2.4.28':443
- '52.##.10.154':443
- '54.##2.2.223':443
- '52.##2.136.59':443
- '54.##2.20.172':443
- '54.##0.15.168':443
- '52.##2.132.5':443
- '54.##0.15.226':443
- '54.##0.0.199':443
- '54.##0.0.221':443
- '52.##.10.208':443
- '52.##2.132.201':443
- '13.#2.4.202':443
- '54.##0.0.251':443
- '13.#2.4.197':443
- '52.##2.136.5':443
- '13.#2.4.9':443
- '13.#2.4.27':443
- '54.#30.0.67':443
- '54.##0.7.180':443
- '54.##2.2.121':443
- '52.##.10.222':443
- '13.#2.4.240':443
- '54.##2.22.112':443
- '52.##2.136.202':443
- '52.##2.132.117':443
- '52.##.10.172':443
- '52.#4.10.12':443
- '54.##2.20.193':443
- '54.##2.22.236':443
- '13.#2.4.77':443
- '54.##2.2.201':443
- '54.#30.0.26':443
- '13.#2.4.220':443
- '13.#2.20.54':443
- '52.#4.7.89':443
- '54.##2.20.232':443
- '13.##.20.172':443
- '54.##0.7.159':443
- '52.#4.7.19':443
- '13.#2.16.6':443
- '54.##0.7.238':443
- '54.##2.22.70':443
- '13.#2.16.71':443
- '52.##.10.197':443
- '52.##2.132.95':443
- '54.##2.22.183':443
- '54.##2.20.197':443
- '54.##0.15.169':443
- '13.#2.4.222':443
- '13.#2.16.87':443
- '54.##0.7.243':443
- '54.##0.0.187':443
- '54.##2.2.210':443
- '54.##0.0.112':443
- '52.##.10.163':443
- '54.##2.2.151':443
- '54.##2.20.69':443
- '54.##0.15.152':443
- '13.#2.4.245':443
- '54.##0.15.114':443
- '13.#2.16.48':443
- '52.##2.136.117':443
- '52.##2.132.129':443
- '52.#4.7.250':443
- '52.##2.136.103':443
- '54.##2.2.231':443
- '13.#2.20.17':443
TCP:
HTTP GET requests:
- http://www.ba##u.com/ via 12#.#25.114.144
- http://co####.getiantem.org/proxies.yaml.gz via localhost
- http://ge#.##tiantem.org/lookup/ via localhost
UDP:
- DNS ASK www.ba##u.com
- DNS ASK pa#.abn.cc
- DNS ASK ea########ownloads.adblockplus.org
- DNS ASK s3.###zonaws.com
- DNS ASK ra#.####ubusercontent.com
Miscellaneous:
Creates and executes the following:
- '%TEMP%\lantern-installer.exe'
- '%APPDATA%\Lantern\lantern.exe'
- '%APPDATA%\byteexec\sysproxy-cmd.exe' on 127.0.0.1 1067
- '%APPDATA%\byteexec\sysproxy-cmd.exe' wait-and-cleanup 127.0.0.1 1067
- '%APPDATA%\byteexec\sysproxy-cmd.exe' show
Executes the following:
- '<SYSTEM32>\cmd.exe' /c del "<Full path to file>"
- '<SYSTEM32>\cmd.exe' ver