Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '62a62bd' = '%APPDATA%\Roaming\62a62bd.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] '*2a62bd' = '%APPDATA%\Roaming\62a62bd.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '62a62b' = 'C:\62a62bd\62a62bd.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] '*2a62b' = 'C:\62a62bd\62a62bd.exe'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
Executes the following:
- '<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\svchost.exe' -k swprv
- '<SYSTEM32>\bcdedit.exe' /set {default} recoveryenabled No
- '%WINDIR%\explorer.exe'
- '<SYSTEM32>\svchost.exe' netsvcs
- '<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
- %WINDIR%\explorer.exe
Modifies file system :
Creates the following files:
- %APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\62a62bd.exe
- %APPDATA%\Roaming\62a62bd.exe
- C:\62a62bd\62a62bd.exe
Network activity:
Connects to:
- 'ni###hnih.com':80
- 'ug##key.com':80
- 'br####sposter.com':80
- 'sw###intin.com':80
- 'cr###atsp.com':80
TCP:
HTTP POST requests:
- sw###intin.com/9dyiec80kk
- cr###atsp.com/9dyiec80kk
- br####sposter.com/9dyiec80kk
- br####sposter.com/nwbiapj1lp
- ni###hnih.com/nwbiapj1lp
- ug##key.com/nwbiapj1lp
- ni###hnih.com/9dyiec80kk
- br####sposter.com/ww2xjsd23p
- ni###hnih.com/ww2xjsd23p
- ug##key.com/ww2xjsd23p
- ug##key.com/9dyiec80kk
- sw###intin.com/ww2xjsd23p
- cr###atsp.com/ww2xjsd23p
- br####sposter.com/61pu1f5pwz928b
- ni###hnih.com/61pu1f5pwz928b
- ug##key.com/61pu1f5pwz928b
- ug##key.com/k0mu7sc3f1q4wg
- sw###intin.com/61pu1f5pwz928b
- cr###atsp.com/61pu1f5pwz928b
- sw###intin.com/5s1vz6676rny
- ug##key.com/5s1vz6676rny
- sw###intin.com/nwbiapj1lp
- cr###atsp.com/nwbiapj1lp
- cr###atsp.com/5s1vz6676rny
- br####sposter.com/5s1vz6676rny
- ni###hnih.com/5s1vz6676rny
- cr###atsp.com/3c0qkyzjcons
- br####sposter.com/3c0qkyzjcons
- ni###hnih.com/3c0qkyzjcons
- ni###hnih.com/ewm4h9749y
- ug##key.com/ewm4h9749y
- sw###intin.com/3c0qkyzjcons
- ug##key.com/3c0qkyzjcons
- ni###hnih.com/afj9uf4793be66z
- ug##key.com/afj9uf4793be66z
- sw###intin.com/8p3fj214h2
- sw###intin.com/afj9uf4793be66z
- cr###atsp.com/afj9uf4793be66z
- br####sposter.com/afj9uf4793be66z
- ni###hnih.com/93w3j2yf3a
- ug##key.com/93w3j2yf3a
- sw###intin.com/h9wuo2k97hh
- sw###intin.com/93w3j2yf3a
- cr###atsp.com/93w3j2yf3a
- br####sposter.com/93w3j2yf3a
- cr###atsp.com/h9wuo2k97hh
- sw###intin.com/ewm4h9749y
- cr###atsp.com/ewm4h9749y
- br####sposter.com/ewm4h9749y
- br####sposter.com/h9wuo2k97hh
- ni###hnih.com/h9wuo2k97hh
- ug##key.com/h9wuo2k97hh
- ni###hnih.com/k0mu7sc3f1q4wg
- br####sposter.com/8p1a488wc6f
- ni###hnih.com/8p1a488wc6f
- ug##key.com/8p1a488wc6f
- ug##key.com/343nx59ttx580
- sw###intin.com/8p1a488wc6f
- cr###atsp.com/8p1a488wc6f
- sw###intin.com/goq561kov9lc8
- ug##key.com/goq561kov9lc8
- sw###intin.com/6rtwe22577319
- cr###atsp.com/6rtwe22577319
- cr###atsp.com/goq561kov9lc8
- br####sposter.com/goq561kov9lc8
- ni###hnih.com/goq561kov9lc8
- ug##key.com/tgrce1c207n9u
- sw###intin.com/3l4tghx8r8f7
- cr###atsp.com/3l4tghx8r8f7
- cr###atsp.com/tgrce1c207n9u
- br####sposter.com/tgrce1c207n9u
- ni###hnih.com/tgrce1c207n9u
- br####sposter.com/3l4tghx8r8f7
- cr###atsp.com/343nx59ttx580
- br####sposter.com/343nx59ttx580
- ni###hnih.com/343nx59ttx580
- ni###hnih.com/3l4tghx8r8f7
- ug##key.com/3l4tghx8r8f7
- sw###intin.com/343nx59ttx580
- ni###hnih.com/zrmge8ntegdbqqs
- ug##key.com/zrmge8ntegdbqqs
- sw###intin.com/iyp5eysmgfcnmcy
- sw###intin.com/zrmge8ntegdbqqs
- cr###atsp.com/zrmge8ntegdbqqs
- br####sposter.com/zrmge8ntegdbqqs
- cr###atsp.com/iyp5eysmgfcnmcy
- sw###intin.com/k0mu7sc3f1q4wg
- cr###atsp.com/k0mu7sc3f1q4wg
- br####sposter.com/k0mu7sc3f1q4wg
- br####sposter.com/iyp5eysmgfcnmcy
- ni###hnih.com/iyp5eysmgfcnmcy
- ug##key.com/iyp5eysmgfcnmcy
- sw###intin.com/oxx2zu1xynmxpr
- cr###atsp.com/oxx2zu1xynmxpr
- br####sposter.com/oxx2zu1xynmxpr
- br####sposter.com/6rtwe22577319
- ni###hnih.com/6rtwe22577319
- ug##key.com/6rtwe22577319
- ni###hnih.com/oxx2zu1xynmxpr
- br####sposter.com/v8vblthrufeyk
- ni###hnih.com/v8vblthrufeyk
- ug##key.com/v8vblthrufeyk
- ug##key.com/oxx2zu1xynmxpr
- sw###intin.com/v8vblthrufeyk
- cr###atsp.com/v8vblthrufeyk
- cr###atsp.com/8p3fj214h2
- cr###atsp.com/b67l8l3e2d
- br####sposter.com/b67l8l3e2d
- ni###hnih.com/b67l8l3e2d
- ni###hnih.com/2rua0k86ud29
- ug##key.com/2rua0k86ud29
- sw###intin.com/b67l8l3e2d
- ug##key.com/b67l8l3e2d
- ni###hnih.com/ph12bw05u2
- ug##key.com/ph12bw05u2
- sw###intin.com/cy9yhf9max0
- sw###intin.com/ph12bw05u2
- cr###atsp.com/ph12bw05u2
- br####sposter.com/ph12bw05u2
- ni###hnih.com/7oiy9rvkbdfyj
- ug##key.com/7oiy9rvkbdfyj
- sw###intin.com/y4znwxblgd2vxjj
- sw###intin.com/7oiy9rvkbdfyj
- cr###atsp.com/7oiy9rvkbdfyj
- br####sposter.com/7oiy9rvkbdfyj
- cr###atsp.com/y4znwxblgd2vxjj
- sw###intin.com/2rua0k86ud29
- cr###atsp.com/2rua0k86ud29
- br####sposter.com/2rua0k86ud29
- br####sposter.com/y4znwxblgd2vxjj
- ni###hnih.com/y4znwxblgd2vxjj
- ug##key.com/y4znwxblgd2vxjj
- br####sposter.com/6z5mfbp9an2a
- ni###hnih.com/6z5mfbp9an2a
- ug##key.com/6z5mfbp9an2a
- ug##key.com/2xampspz3st47up
- sw###intin.com/6z5mfbp9an2a
- cr###atsp.com/6z5mfbp9an2a
- sw###intin.com/1ax3hn355t
- ug##key.com/1ax3hn355t
- sw###intin.com/qm6gzgdyw1828
- cr###atsp.com/qm6gzgdyw1828
- cr###atsp.com/1ax3hn355t
- br####sposter.com/1ax3hn355t
- ni###hnih.com/1ax3hn355t
- ug##key.com/cy9yhf9max0
- sw###intin.com/2tw42o60rj4r4
- cr###atsp.com/2tw42o60rj4r4
- cr###atsp.com/cy9yhf9max0
- br####sposter.com/cy9yhf9max0
- ni###hnih.com/cy9yhf9max0
- br####sposter.com/2tw42o60rj4r4
- cr###atsp.com/2xampspz3st47up
- br####sposter.com/2xampspz3st47up
- ni###hnih.com/2xampspz3st47up
- ni###hnih.com/2tw42o60rj4r4
- ug##key.com/2tw42o60rj4r4
- sw###intin.com/2xampspz3st47up
- ug##key.com/6mwikit3hc70co
- ni###hnih.com/yacb1zofydjiudh
- ug##key.com/yacb1zofydjiudh
- sw###intin.com/a579u6i9hixz3r
- sw###intin.com/yacb1zofydjiudh
- cr###atsp.com/yacb1zofydjiudh
- br####sposter.com/yacb1zofydjiudh
- cr###atsp.com/a579u6i9hixz3r
- sw###intin.com/vrp8nxdsvlag
- cr###atsp.com/vrp8nxdsvlag
- br####sposter.com/vrp8nxdsvlag
- br####sposter.com/a579u6i9hixz3r
- ni###hnih.com/a579u6i9hixz3r
- ug##key.com/a579u6i9hixz3r
- sw###intin.com/q1wqha9j3u4r
- cr###atsp.com/q1wqha9j3u4r
- br####sposter.com/q1wqha9j3u4r
- br####sposter.com/8p3fj214h2
- ni###hnih.com/8p3fj214h2
- ug##key.com/8p3fj214h2
- ni###hnih.com/q1wqha9j3u4r
- br####sposter.com/k9sagpimke1pm
- ni###hnih.com/k9sagpimke1pm
- ug##key.com/k9sagpimke1pm
- ug##key.com/q1wqha9j3u4r
- sw###intin.com/k9sagpimke1pm
- cr###atsp.com/k9sagpimke1pm
- ug##key.com/zhvv200fv2x
- sw###intin.com/uwla66rtu4
- cr###atsp.com/uwla66rtu4
- cr###atsp.com/zhvv200fv2x
- br####sposter.com/zhvv200fv2x
- ni###hnih.com/zhvv200fv2x
- br####sposter.com/uwla66rtu4
- cr###atsp.com/6mwikit3hc70co
- br####sposter.com/6mwikit3hc70co
- ni###hnih.com/6mwikit3hc70co
- ni###hnih.com/uwla66rtu4
- ug##key.com/uwla66rtu4
- sw###intin.com/6mwikit3hc70co
- cr###atsp.com/18vs1134ju9q
- br####sposter.com/18vs1134ju9q
- ni###hnih.com/18vs1134ju9q
- ni###hnih.com/vrp8nxdsvlag
- ug##key.com/vrp8nxdsvlag
- sw###intin.com/18vs1134ju9q
- ug##key.com/18vs1134ju9q
- ni###hnih.com/i2iwtlugiib
- ug##key.com/i2iwtlugiib
- sw###intin.com/zhvv200fv2x
- sw###intin.com/i2iwtlugiib
- cr###atsp.com/i2iwtlugiib
- br####sposter.com/i2iwtlugiib
- ug##key.com/lhhfo5g4xpgzcb
- sw###intin.com/2i98cwfrc99
- cr###atsp.com/2i98cwfrc99
- cr###atsp.com/lhhfo5g4xpgzcb
- br####sposter.com/lhhfo5g4xpgzcb
- ni###hnih.com/lhhfo5g4xpgzcb
- br####sposter.com/2i98cwfrc99
- cr###atsp.com/fu8oxp8kfh
- br####sposter.com/fu8oxp8kfh
- ni###hnih.com/fu8oxp8kfh
- ni###hnih.com/2i98cwfrc99
- ug##key.com/2i98cwfrc99
- sw###intin.com/fu8oxp8kfh
- cr###atsp.com/o2bylj5otmldtd
- br####sposter.com/o2bylj5otmldtd
- ni###hnih.com/o2bylj5otmldtd
- ni###hnih.com/0ie3jdx3d24po
- ug##key.com/0ie3jdx3d24po
- sw###intin.com/o2bylj5otmldtd
- ug##key.com/o2bylj5otmldtd
- ni###hnih.com/5f3z0ebrkbhl07
- ug##key.com/5f3z0ebrkbhl07
- sw###intin.com/lhhfo5g4xpgzcb
- sw###intin.com/5f3z0ebrkbhl07
- cr###atsp.com/5f3z0ebrkbhl07
- br####sposter.com/5f3z0ebrkbhl07
- sw###intin.com/mka4zcfo6pue
- cr###atsp.com/mka4zcfo6pue
- br####sposter.com/mka4zcfo6pue
- br####sposter.com/fp4fhxgedm
- ni###hnih.com/fp4fhxgedm
- ug##key.com/fp4fhxgedm
- ni###hnih.com/mka4zcfo6pue
- br####sposter.com/xbrponxybxwn
- ni###hnih.com/xbrponxybxwn
- ug##key.com/xbrponxybxwn
- ug##key.com/mka4zcfo6pue
- sw###intin.com/xbrponxybxwn
- cr###atsp.com/xbrponxybxwn
- br####sposter.com/c533wo187n7tx
- ni###hnih.com/c533wo187n7tx
- ug##key.com/c533wo187n7tx
- ug##key.com/fu8oxp8kfh
- sw###intin.com/c533wo187n7tx
- cr###atsp.com/c533wo187n7tx
- sw###intin.com/19v9c5uy3r6
- ug##key.com/19v9c5uy3r6
- sw###intin.com/fp4fhxgedm
- cr###atsp.com/fp4fhxgedm
- cr###atsp.com/19v9c5uy3r6
- br####sposter.com/19v9c5uy3r6
- ni###hnih.com/19v9c5uy3r6
- br####sposter.com/0ie3jdx3d24po
- cr###atsp.com/bga8fxx23b1
- br####sposter.com/bga8fxx23b1
- ni###hnih.com/bga8fxx23b1
- ni###hnih.com/hf4a4h96ja
- ug##key.com/hf4a4h96ja
- sw###intin.com/bga8fxx23b1
- ug##key.com/bga8fxx23b1
- ni###hnih.com/2px5x80wc33ag
- ug##key.com/2px5x80wc33ag
- sw###intin.com/ebgbehfbe6roo
- sw###intin.com/2px5x80wc33ag
- cr###atsp.com/2px5x80wc33ag
- br####sposter.com/2px5x80wc33ag
- ni###hnih.com/91j471t4n1zwv5
- ug##key.com/91j471t4n1zwv5
- sw###intin.com/mpp9wkq6dz0n8
- sw###intin.com/91j471t4n1zwv5
- cr###atsp.com/91j471t4n1zwv5
- br####sposter.com/91j471t4n1zwv5
- cr###atsp.com/mpp9wkq6dz0n8
- sw###intin.com/hf4a4h96ja
- cr###atsp.com/hf4a4h96ja
- br####sposter.com/hf4a4h96ja
- br####sposter.com/mpp9wkq6dz0n8
- ni###hnih.com/mpp9wkq6dz0n8
- ug##key.com/mpp9wkq6dz0n8
- br####sposter.com/1a2lfij4re
- ni###hnih.com/1a2lfij4re
- ug##key.com/1a2lfij4re
- ug##key.com/24463smpuc9q
- sw###intin.com/1a2lfij4re
- cr###atsp.com/1a2lfij4re
- sw###intin.com/zaz85dej7aha58
- ug##key.com/zaz85dej7aha58
- sw###intin.com/0ie3jdx3d24po
- cr###atsp.com/0ie3jdx3d24po
- cr###atsp.com/zaz85dej7aha58
- br####sposter.com/zaz85dej7aha58
- ni###hnih.com/zaz85dej7aha58
- ug##key.com/ebgbehfbe6roo
- sw###intin.com/hiaukwqq0okmt
- cr###atsp.com/hiaukwqq0okmt
- cr###atsp.com/ebgbehfbe6roo
- br####sposter.com/ebgbehfbe6roo
- ni###hnih.com/ebgbehfbe6roo
- br####sposter.com/hiaukwqq0okmt
- cr###atsp.com/24463smpuc9q
- br####sposter.com/24463smpuc9q
- ni###hnih.com/24463smpuc9q
- ni###hnih.com/hiaukwqq0okmt
- ug##key.com/hiaukwqq0okmt
- sw###intin.com/24463smpuc9q
- sw###intin.com/zdatrooffcj7
- sw###intin.com/0thdp3wfky2c
- cr###atsp.com/0thdp3wfky2c
- br####sposter.com/0thdp3wfky2c
- br####sposter.com/378x7o2uo3o96a6
- ni###hnih.com/378x7o2uo3o96a6
- ug##key.com/378x7o2uo3o96a6
- ni###hnih.com/0thdp3wfky2c
- br####sposter.com/6s22w4q688
- ni###hnih.com/6s22w4q688
- ug##key.com/6s22w4q688
- ug##key.com/0thdp3wfky2c
- sw###intin.com/6s22w4q688
- cr###atsp.com/6s22w4q688
- br####sposter.com/f14ets0chuabq6r
- ni###hnih.com/f14ets0chuabq6r
- ug##key.com/f14ets0chuabq6r
- ug##key.com/18d5u1f1e7l05
- sw###intin.com/f14ets0chuabq6r
- cr###atsp.com/f14ets0chuabq6r
- sw###intin.com/lb7m6y77n5
- ug##key.com/lb7m6y77n5
- sw###intin.com/378x7o2uo3o96a6
- cr###atsp.com/378x7o2uo3o96a6
- cr###atsp.com/lb7m6y77n5
- br####sposter.com/lb7m6y77n5
- ni###hnih.com/lb7m6y77n5
- cr###atsp.com/vr145bd6pt2qou
- br####sposter.com/vr145bd6pt2qou
- ni###hnih.com/vr145bd6pt2qou
- ni###hnih.com/d7vhzee4z0b
- ug##key.com/d7vhzee4z0b
- sw###intin.com/vr145bd6pt2qou
- ug##key.com/vr145bd6pt2qou
- ni###hnih.com/s3qaoyn870igm
- ug##key.com/s3qaoyn870igm
- sw###intin.com/tgrce1c207n9u
- sw###intin.com/s3qaoyn870igm
- cr###atsp.com/s3qaoyn870igm
- br####sposter.com/s3qaoyn870igm
- ni###hnih.com/ldh1715h2t
- ug##key.com/ldh1715h2t
- sw###intin.com/pvjb2fw1vx4
- sw###intin.com/ldh1715h2t
- cr###atsp.com/ldh1715h2t
- br####sposter.com/ldh1715h2t
- cr###atsp.com/pvjb2fw1vx4
- sw###intin.com/d7vhzee4z0b
- cr###atsp.com/d7vhzee4z0b
- br####sposter.com/d7vhzee4z0b
- br####sposter.com/pvjb2fw1vx4
- ni###hnih.com/pvjb2fw1vx4
- ug##key.com/pvjb2fw1vx4
- ni###hnih.com/18d5u1f1e7l05
- br####sposter.com/my0ug0tgym9x
- ni###hnih.com/my0ug0tgym9x
- ug##key.com/my0ug0tgym9x
- ug##key.com/vu68u162nwo87l1
- sw###intin.com/my0ug0tgym9x
- cr###atsp.com/my0ug0tgym9x
- sw###intin.com/jpjicx7r3u77
- ug##key.com/jpjicx7r3u77
- sw###intin.com/pycppm2prwwk
- cr###atsp.com/pycppm2prwwk
- cr###atsp.com/jpjicx7r3u77
- br####sposter.com/jpjicx7r3u77
- ni###hnih.com/jpjicx7r3u77
- ug##key.com/zdatrooffcj7
- sw###intin.com/nf3yj8yue6
- cr###atsp.com/nf3yj8yue6
- cr###atsp.com/zdatrooffcj7
- br####sposter.com/zdatrooffcj7
- ni###hnih.com/zdatrooffcj7
- br####sposter.com/nf3yj8yue6
- cr###atsp.com/vu68u162nwo87l1
- br####sposter.com/vu68u162nwo87l1
- ni###hnih.com/vu68u162nwo87l1
- ni###hnih.com/nf3yj8yue6
- ug##key.com/nf3yj8yue6
- sw###intin.com/vu68u162nwo87l1
- ni###hnih.com/tci3dysijtsp
- ug##key.com/tci3dysijtsp
- sw###intin.com/zbs430h3l8
- sw###intin.com/tci3dysijtsp
- cr###atsp.com/tci3dysijtsp
- br####sposter.com/tci3dysijtsp
- cr###atsp.com/zbs430h3l8
- sw###intin.com/18d5u1f1e7l05
- cr###atsp.com/18d5u1f1e7l05
- br####sposter.com/18d5u1f1e7l05
- br####sposter.com/zbs430h3l8
- ni###hnih.com/zbs430h3l8
- ug##key.com/zbs430h3l8
- sw###intin.com/80goj3s9ozi826a
- cr###atsp.com/80goj3s9ozi826a
- br####sposter.com/80goj3s9ozi826a
- br####sposter.com/pycppm2prwwk
- ni###hnih.com/pycppm2prwwk
- ug##key.com/pycppm2prwwk
- ni###hnih.com/80goj3s9ozi826a
- br####sposter.com/6uf197jn2j649gh
- ni###hnih.com/6uf197jn2j649gh
- ug##key.com/6uf197jn2j649gh
- ug##key.com/80goj3s9ozi826a
- sw###intin.com/6uf197jn2j649gh
- cr###atsp.com/6uf197jn2j649gh
UDP:
- DNS ASK ni###hnih.com
- DNS ASK ug##key.com
- DNS ASK br####sposter.com
- DNS ASK sw###intin.com
- DNS ASK cr###atsp.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
