Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MhrHcrji' = '<LS_APPDATA>\ebaurodr\mhrhcrji.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,<LS_APPDATA>\ebaurodr\mhrhcrji.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\mhrhcrji.exe
Malicious functions:
Creates and executes the following:
- %TEMP%\empchqloliakgweu.exe
Executes the following:
- <SYSTEM32>\svchost.exe
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtOpenKey, handler: tssofofu.sys
- NtCreateKey, handler: tssofofu.sys
Modifies file system :
Creates the following files:
- %TEMP%\tssofofu.sys
- %WINDIR%\Temp\6decd52f
- %WINDIR%\Temp\7fffffb1
- %TEMP%\empchqloliakgweu.exe
- <LS_APPDATA>\niuydqre.log
- <LS_APPDATA>\ebaurodr\mhrhcrji.exe
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\mhrhcrji.exe
Deletes the following files:
- %TEMP%\tssofofu.sys
Network activity:
Connects to:
- 'vk#####mlufmqwvvu.com':443
- 'yu#####bkyknsbvrui.com':443
- 'kp####tppsmtn.com':443
- 'yy#####ygdpkippa.com':443
- 'ya####bingmhmaf.com':443
- 'sr####tbguwfet.com':443
- '74.##5.232.51':80
- 'ju#####sjbveoqfam.com':443
- 'kf#####qwrnjlmkrl.com':443
- 'nh####fxvyqnebg.com':443
UDP:
- DNS ASK pc###fpntuw.com
- DNS ASK pp###ebx.com
- DNS ASK py#####oxlmtgogfiwl.com
- DNS ASK sc#####mallisjkkag.com
- DNS ASK mc#####mjobninfjna.com
- DNS ASK yh#####fisdxornck.com
- DNS ASK gh#####ocmbfjvgkt.com
- DNS ASK hb#####skqcmbrkf.com
- DNS ASK rv####otdlfglh.com
- DNS ASK yt###slmp.com
- DNS ASK ad###upfbrn.com
- DNS ASK po###prloee.com
- DNS ASK ka###dpo.com
- DNS ASK ew#####rthoadpitts.com
- DNS ASK sf###cvovnj.com
- DNS ASK vw###eynisd.com
- DNS ASK ar#####vchlgpyqgc.com
- DNS ASK gp###wsyshd.com
- DNS ASK oa#####wysnxacmsbow.com
- DNS ASK ey###cefrc.com
- DNS ASK eg###tqrrh.com
- DNS ASK hp#####weoyiamrcpw.com
- DNS ASK ga####ewuuudy.com
- DNS ASK tj###xuxtl.com
- DNS ASK vx###reb.com
- DNS ASK gj###rsykbm.com
- DNS ASK ll####kpjpibv.com
- DNS ASK xt###yrxfcm.com
- DNS ASK ya##o.com
- DNS ASK le#####ugiasvirt.com
- DNS ASK yc#####pfwsngccpcnm.com
- DNS ASK xo#####mdgppqjgdjaa.com
- DNS ASK lj###bhc.com
- DNS ASK lm####hrafvw.com
- DNS ASK rd###tcgq.com
- DNS ASK gr#####cbutgcdfnsuv.com
- DNS ASK tn#####sulchxwefk.com
- DNS ASK jn###bdjkcu.com
- DNS ASK rj####rqemcrhwg.com
- DNS ASK ll#####hwlicvekr.com
- DNS ASK mx###sce.com
- DNS ASK fv####gnkdgr.com
- DNS ASK pl#####ytmmockwbjeb.com
- DNS ASK ue#####jhynkscodc.com
- DNS ASK ha####pvawyb.com
- DNS ASK hx####remopog.com
- DNS ASK xb####buqykdseh.com
- DNS ASK uf###nyrlfp.com
- DNS ASK qd###krc.com
- DNS ASK bk#####rasvbillu.com
- DNS ASK of###bnonpg.com
- DNS ASK ui###gfe.com
- DNS ASK ov####wwfiejsv.com
- DNS ASK yb#####gmkdlureo.com
- DNS ASK dc#####bdthwwddg.com
- DNS ASK mx###qte.com
- DNS ASK et###wehy.com
- DNS ASK fx#####xwwqkqbbhcqi.com
- DNS ASK cf####nybdlnh.com
- DNS ASK ve#####qgifcugyi.com
- DNS ASK oi####aivjpmd.com
- DNS ASK dq###agyhgk.com
- DNS ASK rd#####fvejhhfrtkld.com
- DNS ASK fc#####dqypasmlav.com
- DNS ASK wb###wgnume.com
- DNS ASK su#####dqwqavihf.com
- DNS ASK oc####seopnyhh.com
- DNS ASK xp#####eyefbfofcxqi.com
- DNS ASK nn####ymbtivx.com
- DNS ASK bc#####dfxhvxdsdx.com
- DNS ASK wr###yjkf.com
- DNS ASK jn###reo.com
- DNS ASK ig###tsa.com
- DNS ASK qj####opkoipxeq.com
- DNS ASK ex#####hvjwycxpsme.com
- DNS ASK ya####mootbenii.com
- DNS ASK py####uhjofkbbc.com
- DNS ASK tp###edi.com
- DNS ASK ej####cajudj.com
- DNS ASK ac#####iwldmqlpwku.com
- DNS ASK gg####fqftds.com
- DNS ASK oq####xbnlbi.com
- DNS ASK eb####gpnlnm.com
- DNS ASK ij#####sljxbtotr.com
- DNS ASK da####edlupjcm.com
- DNS ASK fv####qgtfjjyce.com
- DNS ASK se#####vxhqlsafqes.com
- DNS ASK cm###heuh.com
- DNS ASK yu#####bkyknsbvrui.com
- DNS ASK kf#####qwrnjlmkrl.com
- DNS ASK kp####tppsmtn.com
- DNS ASK vk#####mlufmqwvvu.com
- DNS ASK sr####tbguwfet.com
- DNS ASK google.com
- DNS ASK nh####fxvyqnebg.com
- DNS ASK ju#####sjbveoqfam.com
- DNS ASK ya####bingmhmaf.com
- DNS ASK yp####gnusnhhc.com
- DNS ASK dx###jvfnaw.com
- DNS ASK lu###icrni.com
- DNS ASK wy####kaaisyp.com
- DNS ASK ur####ncfbxsk.com
- DNS ASK yy#####ygdpkippa.com
- DNS ASK pj#####iqfqyawojk.com
- DNS ASK vf###mselcv.com
- DNS ASK er#####uqcnbtkubh.com
- DNS ASK xb###mjuqya.com
- DNS ASK li###nmmkbi.com
- DNS ASK lc###nkpyoj.com
- DNS ASK py###yjydi.com
- DNS ASK jm####usyhombk.com
- DNS ASK kf###wugxk.com
- DNS ASK aw#####molkitdqhwut.com
- DNS ASK rg###ioiqm.com
- DNS ASK cc####kuamaths.com
- DNS ASK bing.com
- DNS ASK ak####twdfkdc.com
- DNS ASK fi####bejrshvu.com
- DNS ASK lk#####anxcjsidn.com
- DNS ASK ec###ammark.com
- DNS ASK nh#####txoqsstgj.com
- DNS ASK kf#####oechqgryajnc.com
- DNS ASK wy###nvsl.com
- DNS ASK nw#####tevxlepfuxw.com
- DNS ASK qh#####spsnwouayf.com
- DNS ASK sl#####shvktbvgdduh.com
- DNS ASK ak####ecjnghqtc.com
- DNS ASK qh###iukkv.com
- DNS ASK uw###etjdp.com
- DNS ASK af#####gaayynvgfaw.com
- DNS ASK wf#####kwrqcmldako.com
- DNS ASK ns####yruivqvla.com
- DNS ASK gw###iwlgu.com
- DNS ASK pe###olu.com
- DNS ASK wx#####axhkqddbb.com
- DNS ASK nr####xgpkmnxgf.com
- DNS ASK pq#####ushsjhiqqxa.com
- DNS ASK lp#####uqxswhkyak.com
- DNS ASK lk###ore.com
- DNS ASK rm###via.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
