Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Host' = '%ALLUSERSPROFILE%\Windows Host\Windows Host.exe'
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\2146069.exe
- %ALLUSERSPROFILE%\42\64ecdfd0f29319f626ce02708fb57f04.txt
- %ALLUSERSPROFILE%\42\9ba57b3693641b43b7c14832a72664f3.txt
- %ALLUSERSPROFILE%\42\f890a21d360fa64e634f545e751d4669.txt
- %ALLUSERSPROFILE%\42\nss3.dll
- %ALLUSERSPROFILE%\42\msvcp140.dll
- %ALLUSERSPROFILE%\42\mozglue.dll
- %ALLUSERSPROFILE%\42\freebl3.dll
- %ALLUSERSPROFILE%\42\vcruntime140.dll
- %ALLUSERSPROFILE%\42\sqlite3.dll
- %ALLUSERSPROFILE%\42\softokn3.dll
- %ALLUSERSPROFILE%\4243
- %ALLUSERSPROFILE%\windows host\windows host.exe
- %ALLUSERSPROFILE%\6463825.exe
- %ALLUSERSPROFILE%\4260866.exe
- %ALLUSERSPROFILE%\1621479.exe
- %ALLUSERSPROFILE%\42\2e4b46ca434670c00da343ffff387905.txt
- %ALLUSERSPROFILE%\42\02866d7ce5a3e2e4f41636e5eb8d4b10.txt
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\windows host\windows host.exe
Deletes the following files
- %ALLUSERSPROFILE%\42\02866d7ce5a3e2e4f41636e5eb8d4b10.txt
- %ALLUSERSPROFILE%\42\2e4b46ca434670c00da343ffff387905.txt
- %ALLUSERSPROFILE%\42\64ecdfd0f29319f626ce02708fb57f04.txt
- %ALLUSERSPROFILE%\42\9ba57b3693641b43b7c14832a72664f3.txt
- %ALLUSERSPROFILE%\42\f890a21d360fa64e634f545e751d4669.txt
- %ALLUSERSPROFILE%\42\freebl3.dll
- %ALLUSERSPROFILE%\42\mozglue.dll
- %ALLUSERSPROFILE%\42\msvcp140.dll
- %ALLUSERSPROFILE%\42\nss3.dll
- %ALLUSERSPROFILE%\42\softokn3.dll
- %ALLUSERSPROFILE%\42\sqlite3.dll
- %ALLUSERSPROFILE%\42\vcruntime140.dll
- %ALLUSERSPROFILE%\4243
Network activity
TCP
- 'pi###-dcn.xyz':443
- 'po####ns3rts.xyz':443
UDP
- DNS ASK pi###-dcn.xyz
- DNS ASK po####ns3rts.xyz
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\2146069.exe'
- '%ALLUSERSPROFILE%\1621479.exe'
- '%ALLUSERSPROFILE%\4260866.exe'
- '%ALLUSERSPROFILE%\windows host\windows host.exe'
