Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\b3852256de5edec] 'ImagePath' = '<DRIVERS>\b3852256de5edec.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\b3852256de5edec] 'Start' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\syshost32] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\2a212] 'Start' = '00000001'
Malicious functions:
Creates and executes the following:
- '%WINDIR%\Installer\{E57D208A-0DCA-C4E3-AF29-51A089755625}\syshost.exe' /service
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtOpenThread, handler: unknown
- NtOpenProcess, handler: unknown
Modifies file system :
Creates the following files:
- <DRIVERS>\b3852256de5edec.sys
- %WINDIR%\Temp\RGI1.tmp
- %WINDIR%\Installer\{E57D208A-0DCA-C4E3-AF29-51A089755625}\syshost.exe
- <DRIVERS>\2a212.sys
Deletes the following files:
- <DRIVERS>\2a212.sys
Moves itself:
- from <Full path to virus> to %TEMP%\90e5b7a8.tmp
Deletes itself.
Network activity:
Connects to:
- '62.##.229.134':80
- 'fa###ook.com':80
- '20#.#6.232.182':80
- '62.##.229.126':80
TCP:
HTTP POST requests:
- 62.##.229.134/cgi-bin/auth.cgi
- 62.##.229.126/cgi-bin/auth.cgi
UDP:
- DNS ASK eg####pjwhjbmg.ms
- DNS ASK ww####kdcregm.ki
- DNS ASK vg###rtreejg.cc
- DNS ASK mw####nrkyvpc.cm
- DNS ASK cx###hctyv.im
- DNS ASK jn#####plchpvgoamed.tj
- DNS ASK ku###ajvtswi.nf
- DNS ASK yl#####qwwdkfxhci.cx
- DNS ASK mq####cjemetobw.tj
- DNS ASK lc#######apotdxhbqkwupumq.sc
- DNS ASK rs#####gtcecaupask.im
- DNS ASK rq###vctjni.ms
- DNS ASK kb######qttdvnrvjixodi.mu
- DNS ASK fg#######kqtgqkvafrnjtegk.la
- DNS ASK tx###thcrlx.ki
- DNS ASK wc###vxywhti.in
- DNS ASK te###sohnjhm.la
- DNS ASK wh###lfvkej.ac
- DNS ASK ig###mbndeqr.ms
- DNS ASK lk#####kqeynmydsr.in
- DNS ASK yb######wwtqfrflbfxvy.im
- DNS ASK xf#####qxupcjqffoajy.jp
- DNS ASK nf#####lfahifbpaaum.cx
- DNS ASK cu#####lbellifwwh.ki
- DNS ASK to###fgluaxx.sh
- DNS ASK va#######klhocnnwpmavedsh.tj
- DNS ASK em####wyuerseldh.mn
- DNS ASK bi######wdcoptwmbdsjs.so
- DNS ASK vw####gpuyfdjt.jp
- DNS ASK yv#######npykjpllrescmkvt.mn
- DNS ASK wl###vjprnd.so
- DNS ASK bl#####xjhmgnkoogt.sc
- DNS ASK mp####njrxchx.la
- DNS ASK ea######sskerpvfhukqrw.im
- DNS ASK jv######dqblaasksmprt.cc
- DNS ASK kr#######udkikcrmdjwebieu.nu
- DNS ASK by######syudgyfpbuhijgb.im
- DNS ASK ir###ncqguxr.tj
- DNS ASK ed######pswvuejjqahwaa.cc
- DNS ASK aq######oslqauwbyambawlg.in
- DNS ASK hk####dpcjuehes.sh
- DNS ASK ot######awvkxlmjnutset.im
- DNS ASK tk###qpurw.ki
- DNS ASK jh#####mdeinpwkoyjg.cc
- DNS ASK op#####gedowwggnwd.mn
- DNS ASK bf####uoycvam.nf
- DNS ASK ul###fnays.nf
- DNS ASK eo######bvtgpaeantfvdpq.sc
- DNS ASK iq####ebvupke.tw
- DNS ASK av###kydvdhq.sh
- DNS ASK gi#####rbbulbjqwrn.ac
- DNS ASK fo#####hmjhcwsumq.im
- DNS ASK fj#####ynrocnyioe.cx
- DNS ASK nk####mefqwey.nu
- DNS ASK fl####rapigiqrao.sc
- DNS ASK js######whhckkuqihjkl.so
- DNS ASK qc#####jvfunmmwag.la
- DNS ASK bt#####ovksahmchfnqa.cc
- DNS ASK dc#####xqvabpqcla.sh
- DNS ASK gf#####ffstqekpvwjlm.in
- DNS ASK jn#######uypowwcrjbnkfudf.nu
- DNS ASK gr####vxttxeewmm.ac
- DNS ASK wr#####xjptnlwtxy.tw
- DNS ASK xc###omeev.la
- DNS ASK oi#####eedcoeyrsfeiw.sc
- DNS ASK ct###yodupv.tj
- DNS ASK rl###xdatmg.com
- DNS ASK in####kyufrfv.com
- DNS ASK fa###ook.com
- DNS ASK microsoft.com
- DNS ASK nf####byjhym.com
- DNS ASK yr###zmprty.com
- DNS ASK ci###uxesyg.com
- DNS ASK we###dimtw.so
- DNS ASK ra#####osytibjlgaj.cc
- DNS ASK bj######lyvopgvgvywydd.jp
- DNS ASK rv####msginwcco.com
- DNS ASK xa###rglwd.com
- DNS ASK wk###ibpho.com
- DNS ASK ow#####wmffuurwktddt.so
- DNS ASK rr#####ljuqbcajxc.nf
- DNS ASK wg######xuhrjugoxevbocke.in
- DNS ASK ea#####ilaojurqde.ki
- DNS ASK dv#####ldyfwpdwyuck.tj
- DNS ASK nh###flsml.jp
- DNS ASK dh#######mchnhsbfdyrcvuto.ms
- DNS ASK wb######vlxvmabhmcksbrt.la
- DNS ASK cw###ntasbv.sc
- DNS ASK jb####cmcbceoenx.so
- DNS ASK sa######tqyrmfyxhadhfy.ms
- DNS ASK vq#####evgubvnmtrkj.jp
- DNS ASK ps####pppcbwp.tj
- DNS ASK rn######ggmiynorwroelmw.im
- DNS ASK cn####adeplbwyst.cm
- DNS ASK ga######nctdcidsrvrlso.tj
- DNS ASK jm######uevhpgnismkrdfnu.in
- DNS ASK xg###xrduksh.so
- DNS ASK lc####aweprai.tw
- DNS ASK fs####hjupwduxcf.mu
- DNS ASK wy####lnolawwbc.mn
- DNS ASK ig######vrluqggknpmvoq.ki
- DNS ASK af######qpvamxoefhkhrv.ki
- DNS ASK xd#######mjcbueivpxpkjiqy.tj
- DNS ASK kc####gpxbjrb.cx
- DNS ASK rc####sgxcompnnv.mu
- DNS ASK rb#####kkcbkietslb.ki
