Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\64046d14be6536d8] 'ImagePath' = '<DRIVERS>\64046d14be6536d8.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\64046d14be6536d8] 'Start' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\syshost32] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\19c89] 'Start' = '00000001'
Malicious functions:
Creates and executes the following:
- %WINDIR%\Installer\{9AFC887C-5E96-5A65-2159-CEBC0138D794}\syshost.exe /service
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtOpenThread, handler: unknown
- NtOpenProcess, handler: unknown
Modifies file system :
Creates the following files:
- <DRIVERS>\64046d14be6536d8.sys
- <DRIVERS>\19c89.sys
- %WINDIR%\Installer\{9AFC887C-5E96-5A65-2159-CEBC0138D794}\syshost.exe
Moves itself:
- from <Full path to virus> to %TEMP%\cd0fe830.tmp
Deletes itself.
Network activity:
Connects to:
- '62.##.229.134':80
- 'eq###lgtqg.ac':80
- 'fa###ook.com':80
- '62.##.229.126':80
TCP:
HTTP POST requests:
- eq###lgtqg.ac/database.cgi
- 62.##.229.134/cgi-bin/auth.cgi
- 62.##.229.126/cgi-bin/auth.cgi
UDP:
- DNS ASK ms######dqfwtrlnftcbo.cm
- DNS ASK pl######rsrouxswxkhqbur.ac
- DNS ASK he######qcmaillwjgtdsg.la
- DNS ASK gg###hhdsu.tw
- DNS ASK ww######naeqixjsycytdn.cx
- DNS ASK rh######wljcymoyhjseirrb.nf
- DNS ASK cy####orrhrewcnn.mn
- DNS ASK fw#######rsenyyorewervhnd.so
- DNS ASK jh####nemjtqxrf.la
- DNS ASK ib#######daeksgtupfjfnthr.mn
- DNS ASK ks######ecydhrjuilbgirt.im
- DNS ASK jj#####jpqwsqmaustx.cm
- DNS ASK xv######qythkaqwpkavopy.jp
- DNS ASK of######fryxbsvhjibwduh.nu
- DNS ASK fp#####ymtbcgxtcs.cm
- DNS ASK yx######nlwtvfxpkwmprsxy.nf
- DNS ASK uk######dxtydqklxcuoy.mn
- DNS ASK mk#####jelbukdseon.cx
- DNS ASK pw####whtgrkegv.sh
- DNS ASK yi#####ehcwrvwmexdo.cc
- DNS ASK ar######sbupedvyqafyimsy.ac
- DNS ASK dd######fgfcihdnfxwvvlam.la
- DNS ASK xr####nuumccvan.so
- DNS ASK tw###ngotiob.nf
- DNS ASK pm####nqemgmhshc.mu
- DNS ASK rf######xfuwwgqlrjokexq.tw
- DNS ASK vy######qddjejjgcgrtyqr.cm
- DNS ASK hp######jgyurdjwokcpilsj.ms
- DNS ASK id#####eagbfpmvly.mn
- DNS ASK gb####htdqrsyrj.ki
- DNS ASK dc###iagqpa.cc
- DNS ASK vs###kaxye.mn
- DNS ASK ny####kkmdhmitgb.cc
- DNS ASK to#####gsfuphjsibrfp.tw
- DNS ASK om####ppbwmocnw.tj
- DNS ASK ph#####eudndpagivxwn.so
- DNS ASK de####mnipmqtnrd.mn
- DNS ASK og###xhmnojr.in
- DNS ASK qn######efixvgucdvvno.cx
- DNS ASK cw#####rcguvjwllds.tj
- DNS ASK cb####qbkvgih.mu
- DNS ASK wt######iehyrlpimsvyra.sh
- DNS ASK kj###getmxcq.nu
- DNS ASK nq######mgxohvujvpefalcf.cm
- DNS ASK pn######tremblervbhgrtlp.cm
- DNS ASK ca#####raogitfmwhfk.nu
- DNS ASK eu#####blsuqfhpsmld.sc
- DNS ASK ek######wpbdjpqylsxwhuuv.sc
- DNS ASK dd######sqxlubvsromqktcv.cx
- DNS ASK ye######rwxmurnefiklhv.ac
- DNS ASK nx######pwwhhaxgmxdvjo.ac
- DNS ASK ik#####stwjvaoqemt.so
- DNS ASK tt####rclluyjwfo.im
- DNS ASK sp#####ttramokugpukw.mn
- DNS ASK ds######feihlbhmuowhrl.mn
- DNS ASK cv#####aymdrvgcyvbyf.so
- DNS ASK wp#######ujgkiuqtwsynsdku.cm
- DNS ASK sm####dhalxnlij.com
- DNS ASK ui####mljczveu.com
- DNS ASK bg###bvvnl.com
- DNS ASK fa###ook.com
- DNS ASK od####gkadmezr.com
- DNS ASK uo####mbondza.com
- DNS ASK eq###lgtqg.ac
- DNS ASK bn#####usbuwecchbbcn.tw
- DNS ASK uh####emewykp.com
- DNS ASK wa####imlihgci.com
- DNS ASK nj###yzeime.com
- DNS ASK cr######hdgsjqrpfnnxvagv.im
- DNS ASK kv######oqiosbqlgpcdbwm.cc
- DNS ASK tr######ruavonojmjjtw.tj
- DNS ASK ld######hlkuwwkwxdxkxswc.nf
- DNS ASK hr####oealfyh.cx
- DNS ASK il#####misrcmvqtgluj.jp
- DNS ASK dv####ssvpmfbwc.cm
- DNS ASK bw#######msgccrnmomibynim.cm
- DNS ASK hk######jfcmfoadqrfscdr.jp
- DNS ASK jg######hugyoacalqelvv.sh
- DNS ASK td#####ohybxpwqdhgw.tj
- DNS ASK sg#####ydbsqnhmkks.sh
- DNS ASK qu######agvhcqjayyaonn.nf
- DNS ASK iy####bhfhlvx.nf
- DNS ASK gj###ojaunm.sc
- DNS ASK nj#####jsfrtevgdtp.tj
- DNS ASK oj#####krdmcpcadkra.ac
- DNS ASK pm#######wggmspdcdvrykrwt.ac
- DNS ASK vp####ddtbxcwcmt.in
- DNS ASK qs####qgexulgje.tw
- DNS ASK vs######swuiycamnwefb.tj
- DNS ASK nn#####xoemnogerifwb.so
- DNS ASK ox######iphqwjlexcpfdwn.ki