Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'CSRSS' = '"%ALLUSERSPROFILE%\Drivers\csrss.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"%WINDIR%\rss\csrss.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent b3b1d76277792392
- <SYSTEM32>\tasks\firefox default browser agent 7f983a27e769ece9
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\VBoxWddm] 'ImagePath' = 'VBoxWddm'
- [HKLM\System\CurrentControlSet\Services\VBoxSF] 'ImagePath' = 'VBoxSF'
- [HKLM\System\CurrentControlSet\Services\VBoxMouse] 'ImagePath' = 'VBoxMouse'
- [HKLM\System\CurrentControlSet\Services\VBoxGuest] 'ImagePath' = 'VBoxGuest'
- [HKLM\System\CurrentControlSet\Services\VBoxService] 'ImagePath' = 'VBoxService'
Creates the following services
- 'VBoxWddm' VBoxWddm
- 'VBoxSF' VBoxSF
- 'VBoxMouse' VBoxMouse
- 'VBoxGuest' VBoxGuest
- 'VBoxService' VBoxService
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\rss' = '00000000'
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\csrss' = '00000000'
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\windefender.exe' = '00000000'
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '<DRIVERS>' = '00000000'
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes] 'csrss.exe' = '00000000'
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes] 'windefender.exe' = '00000000'
- [HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes] '288c47bbc1871b439df19ff4df68f076.exe' = '00000000'
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\installutil.exe
- %WINDIR%\syswow64\explorer.exe
- %WINDIR%\explorer.exe
the following user processes:
- iexplore.exe
- firefox.exe
Modifies file system
Creates the following files
- %APPDATA%\avggght
- %TEMP%\nsgae4b.tmp
- nul
- %WINDIR%\rss\csrss.exe
- %APPDATA%\hwjidrc
- %TEMP%\nsq5763.tmp
- %TEMP%\nsl5793.tmp\inetc.dll
- %APPDATA%\idggght
- %TEMP%\broomsetup.exe
- %TEMP%\288c47bbc1871b439df19ff4df68f076.exe
- %TEMP%\installsetup9.exe
- %TEMP%\3b87.exe
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite-shm
- %TEMP%\protect544cd51a.dll
- %TEMP%\4kpv6a~1\cached-microdesc-consensus.tmp
- %TEMP%\4kpv6a~1\cached-certs.tmp
- %TEMP%\4kpv6a~1\unverified-microdesc-consensus.tmp
- %TEMP%\b1b7.dll
- %TEMP%\abcc.exe
- %TEMP%\a2a7.exe
- %TEMP%\4kpv6a~1\state.tmp
- %ALLUSERSPROFILE%\drivers\csrss.exe
- %TEMP%\9158.exe
- %TEMP%\7d4b.exe
- %TEMP%\7158.exe
- %TEMP%\4kpv6a~1\cached-microdescs.new
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite-shm
Sets the 'hidden' attribute to the following files
- %APPDATA%\avggght
- %ALLUSERSPROFILE%\drivers\csrss.exe
- %APPDATA%\idggght
- %APPDATA%\hwjidrc
Deletes the following files
- %TEMP%\4kpv6a~1\unverified-microdesc-consensus
- %TEMP%\4kpv6a~1\cached-certs
- %TEMP%\4kpv6a~1\state
- %TEMP%\abcc.exe
- %TEMP%\nsq5763.tmp
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite-shm
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite-shm
- %TEMP%\nsgae4b.tmp
- %TEMP%\nsl5793.tmp\inetc.dll
Moves the following files
- from %TEMP%\4kpv6a~1\state.tmp to %TEMP%\4kpv6a~1\state
- from %TEMP%\4kpv6a~1\unverified-microdesc-consensus.tmp to %TEMP%\4kpv6a~1\unverified-microdesc-consensus
- from %TEMP%\4kpv6a~1\cached-certs.tmp to %TEMP%\4kpv6a~1\cached-certs
- from %TEMP%\4kpv6a~1\cached-microdesc-consensus.tmp to %TEMP%\4kpv6a~1\cached-microdesc-consensus
Modifies the following files
Substitutes the following files
- %TEMP%\4kpv6a~1\cached-certs.tmp
- %TEMP%\4kpv6a~1\cached-certs
- %TEMP%\4kpv6a~1\state.tmp
- %TEMP%\4kpv6a~1\state
Deletes itself.
Network activity
Connects to
- 'se####ation17io.io':80
- 'fp####0532xc.com':80
- '91.##.255.226':80
- 'ap#.#pify.org':80
- 'ft###yager.cc':80
- 'st####ommunity.com':443
- 't.#e':443
- '5.##.66.0':80
- '95.##7.25.10':443
- 'localhost':47129
- '98.##8.173.1':9001
- '51.#1.93.39':443
- '62.##6.85.110':34049
- 'hu##.##pteamlife.com':443
- '13#.#62.210.252':443
- 'yo######tophalalshop.com':443
- 'localhost':49186
- 'pk#.goog':80
- '18#.#72.128.53':80
TCP
HTTP GET requests
- http://pk#.goog/gsr1/gsr1.crt
- http://5.##.66.0/288c47bbc187122b439df19ff4df68f076.exe
- http://ft###yager.cc/ftp/index.php
- http://ap#.#pify.org/?fo########
- http://18#.#72.128.53/syncUpd.exe
HTTP POST requests
- http://se####ation17io.io/index.php
- http://fp####0532xc.com/index.php
Other
- 'yo######tophalalshop.com':443
- '13#.#62.210.252':443
- 'hu##.##pteamlife.com':443
- '98.##8.173.1':9001
- '51.#1.93.39':443
- 'localhost':47129
- 'localhost':49198
- 't.#e':443
- 'st####ommunity.com':443
- '95.##7.25.10':443
UDP
- DNS ASK se####ation17io.io
- DNS ASK yo######tophalalshop.com
- DNS ASK hu##.##pteamlife.com
- DNS ASK pk#.goog
- DNS ASK t.#e
- DNS ASK st####ommunity.com
- DNS ASK ft###yager.cc
- DNS ASK ap#.#pify.org
- DNS ASK le###ls2369.com
- DNS ASK fp####0532xc.com
- DNS ASK lu###aass.site
Miscellaneous
Searches for the following windows
- ClassName: 'msctls_updown32' WindowName: ''
Creates and executes the following
- '%TEMP%\7158.exe'
- '%TEMP%\broomsetup.exe'
- '%TEMP%\nsgae4b.tmp'
- '%TEMP%\288c47bbc1871b439df19ff4df68f076.exe'
- '%TEMP%\installsetup9.exe'
- '%WINDIR%\rss\csrss.exe'
- '%TEMP%\abcc.exe'
- '%TEMP%\a2a7.exe'
- '%TEMP%\7d4b.exe'
- '%TEMP%\3b87.exe'
- '%TEMP%\9158.exe'
- '<SYSTEM32>\schtasks.exe' /delete /tn ScheduledUpdate /f' (with hidden window)
- '%TEMP%\csrss\patch.exe' ' (with hidden window)
- '%TEMP%\csrss\injector\injector.exe' taskmgr.exe %TEMP%\csrss\injector\NtQuerySystemInformationHook.dll' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes"' (with hidden window)
- '%WINDIR%\rss\csrss.exe' ' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /CREATE /SC ONLOGON /RL HIGHEST /TR "%WINDIR%\rss\csrss.exe" /TN csrss /F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c timeout /t 5 & del /f /q "%TEMP%\nsgAE4B.tmp" & del "%ALLUSERSPROFILE%\*.dll"" & exit' (with hidden window)
Executes the following
- '<SYSTEM32>\regsvr32.exe' /s %TEMP%\B1B7.dll
- '%WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\installutil.exe'
- '<SYSTEM32>\cmd.exe' /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes"
- '%WINDIR%\syswow64\explorer.exe'
- '%WINDIR%\explorer.exe'
- '<SYSTEM32>\schtasks.exe' /CREATE /SC ONLOGON /RL HIGHEST /TR "%WINDIR%\rss\csrss.exe" /TN csrss /F
- '<SYSTEM32>\schtasks.exe' /delete /tn ScheduledUpdate /f
- '%WINDIR%\syswow64\cmd.exe' /c timeout /t 5 & del /f /q "%TEMP%\nsgAE4B.tmp" & del "%ALLUSERSPROFILE%\*.dll"" & exit
- '%WINDIR%\syswow64\timeout.exe' /t 5
