Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\a72a1ac3] 'ImagePath' = '%WINDIR%\3273271975:1490412860.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\.afd] 'ImagePath' = '\*'
Malicious functions:
Creates and executes the following:
- %HOMEPATH%\zoh.exe
- %HOMEPATH%\zog.exe
- %HOMEPATH%\Y4u5h60580.exe
Executes the following:
- %WINDIR%\explorer.exe
Injects code into
the following system processes:
- <SYSTEM32>\winlogon.exe
Modifies file system :
Creates the following files:
- %WINDIR%\3273271975:1490412860.exe
- %WINDIR%\$NtUninstallKB16918$\2804554435\Desktop.ini
- %WINDIR%\$NtUninstallKB16918$\2804554435\cfg.ini
- %WINDIR%\$NtUninstallKB16918$\2804554435\L\acbrwqkz
- %HOMEPATH%\zog.exe
- %HOMEPATH%\Y4u5h60580.exe
- %HOMEPATH%\nuoip.exe
- %HOMEPATH%\zoh.exe
Deletes the following files:
- %HOMEPATH%\zog.exe
Deletes itself.
Network activity:
Connects to:
- '18#.#0.85.252':80
TCP:
HTTP GET requests:
- 18#.#0.85.252/stat2.php?w=#########################################
- 18#.#0.85.252/stat2.php?w=########################################
UDP:
- DNS ASK so###haghd.com
