Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\dbd1538736321ca9] 'ImagePath' = '<DRIVERS>\dbd1538736321ca9.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\dbd1538736321ca9] 'Start' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\syshost32] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\2384c] 'Start' = '00000001'
Malicious functions:
Creates and executes the following:
- %WINDIR%\Installer\{09522678-9626-44A3-801D-430A5ACD28AF}\syshost.exe /service
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtOpenThread, handler: unknown
- NtOpenProcess, handler: unknown
Modifies file system :
Creates the following files:
- <DRIVERS>\dbd1538736321ca9.sys
- <DRIVERS>\2384c.sys
- %WINDIR%\Installer\{09522678-9626-44A3-801D-430A5ACD28AF}\syshost.exe
Deletes the following files:
- <DRIVERS>\2384c.sys
Moves itself:
- from <Full path to virus> to %TEMP%\47a6ca94.tmp
Deletes itself.
Network activity:
Connects to:
- 'kq###ikipwg.cx':80
- 'kl####igcbuec.cx':80
- 'hg####hbtmfsiry.tj':80
- 'rn####rorfwtopf.ki':80
- 'nm####dlpwjlf.ms':80
- 'dv######cghqfwmbafvycs.ac':80
- '62.##.229.134':80
- 'fa###ook.com':80
- '62.##.229.126':80
- 'nc###vosdey.ki':80
- 'nt####nyxbcnpga.mn':80
TCP:
HTTP POST requests:
- kq###ikipwg.cx/database.cgi
- kl####igcbuec.cx/database.cgi
- hg####hbtmfsiry.tj/database.cgi
- rn####rorfwtopf.ki/database.cgi
- nm####dlpwjlf.ms/database.cgi
- 62.##.229.126/cgi-bin/auth.cgi
- 62.##.229.134/cgi-bin/auth.cgi
- nt####nyxbcnpga.mn/database.cgi
- dv######cghqfwmbafvycs.ac/database.cgi
- nc###vosdey.ki/database.cgi
UDP:
- DNS ASK ug###kehqkgs.cm
- DNS ASK yy#####njaptjdajlq.nf
- DNS ASK me######asnbkjqamecsqbd.in
- DNS ASK ei####kyfakxkw.la
- DNS ASK ou######opikjfsnfbkfsvi.tw
- DNS ASK bc######mvpfouyarcshfh.tj
- DNS ASK lg###nvlyqf.jp
- DNS ASK dw####uqqrdvwcov.mu
- DNS ASK ma#####ibmvxtxkwdo.cm
- DNS ASK dr######rkuccdyexkbpgfd.sc
- DNS ASK rt###dothgq.tj
- DNS ASK iv######yxaifpiiwaeiprdj.jp
- DNS ASK gv######iammontoyplstrw.ki
- DNS ASK nm#####ftdkehsgpdmu.in
- DNS ASK vj######qibcusqwiydmi.tw
- DNS ASK lm####mjtawsheqm.nf
- DNS ASK ks#####tbcsofgfmeogx.nf
- DNS ASK xq######rlkthlitgpowggmb.mu
- DNS ASK ym#####kjxtplsmer.jp
- DNS ASK fu####tuisugsgly.mu
- DNS ASK tu####jqycotosad.jp
- DNS ASK tr#####ahugbypaqpysf.nf
- DNS ASK ou####euelgyrkkk.mu
- DNS ASK gn###fldpl.mn
- DNS ASK tl####tltpqautn.mu
- DNS ASK ai#######sahqbhcoyqeofsen.cx
- DNS ASK or###rlgadk.mn
- DNS ASK ve###urflf.sc
- DNS ASK uy###gcbux.im
- DNS ASK rx####vdortdg.mn
- DNS ASK js###jsjcink.cc
- DNS ASK iu####xemihoihu.cm
- DNS ASK sx####htsqvciwo.nu
- DNS ASK ke######xogplnedusngumfc.tj
- DNS ASK wq####ywmuqxhyrr.tj
- DNS ASK vr###xjfmjbm.ki
- DNS ASK ys######tfyemjuebwhtxks.la
- DNS ASK gd####nudcvqinb.cm
- DNS ASK si####klmwarft.mn
- DNS ASK vo######wfyevrlaibxhl.nu
- DNS ASK ux######fmqymdfivqarcy.cx
- DNS ASK kl#####gdqodqwcytpu.cm
- DNS ASK mv######sjfdholjowvtpjkt.cm
- DNS ASK js###wequu.in
- DNS ASK ph#####svsqcalaicgf.mu
- DNS ASK kj####dqtaibaqh.cx
- DNS ASK oe#######skxosoybjtjnltdy.in
- DNS ASK fs####qopwrsol.so
- DNS ASK vs######lnxakxyywgpfngw.ac
- DNS ASK qk#####jdyycbtwpun.sc
- DNS ASK yd#####ewmbfupdset.nf
- DNS ASK jc###qtkur.cc
- DNS ASK mv#######ugctbedmfvqwvgex.mu
- DNS ASK rn####rorfwtopf.ki
- DNS ASK je######jmyccrbcrajub.la
- DNS ASK qc#####dpnxqbrmrnvx.so
- DNS ASK kq###ikipwg.cx
- DNS ASK hg####hbtmfsiry.tj
- DNS ASK nm####dlpwjlf.ms
- DNS ASK lv#####pncrduhcvtqsr.ms
- DNS ASK rv###tvnokis.ki
- DNS ASK ms######viefheavcsoooo.tj
- DNS ASK ew#####qvwcuretksogn.mn
- DNS ASK jc####imnrkkmmmm.nu
- DNS ASK ve#####msuspkibrgk.ki
- DNS ASK lg####inncwthq.nu
- DNS ASK ib###lnupht.com
- DNS ASK ca####jswfvum.com
- DNS ASK ba###xkesi.com
- DNS ASK fa###ook.com
- DNS ASK bh####rdynor.com
- DNS ASK ot####vbryhwwcn.com
- DNS ASK sb####yzezyydvy.com
- DNS ASK nt####nyxbcnpga.mn
- DNS ASK dv######cghqfwmbafvycs.ac
- DNS ASK kl####igcbuec.cx
- DNS ASK ip###wajyw.com
- DNS ASK tl####jbddrlv.com
- DNS ASK nc###vosdey.ki
- DNS ASK ce###ctvnem.cc
- DNS ASK jy#####daroikssyqes.ms
- DNS ASK ra###uosqxm.ki
- DNS ASK ai#######fjascwqalajcbbdp.la
- DNS ASK qt######otcrcvrboiyejl.cx
- DNS ASK wi######yinjbkbjmnajg.tj
- DNS ASK hl###raqrgfs.jp
- DNS ASK rb#####hmtnmcajohul.cx
- DNS ASK xk###eyrybgv.mu
- DNS ASK et####sdfsfbsl.so
- DNS ASK ub###afjig.tj
- DNS ASK ih#####cisspphbroxcr.la
- DNS ASK hy######kgmbrihhwmkuwbhu.mn
- DNS ASK sv######qgwkmhwhtpmyay.mn
- DNS ASK na###jungjj.im
- DNS ASK vk####pytmijdslo.ac
- DNS ASK hx######rdsumwsgladge.nu
- DNS ASK pu####tgetqpmc.tw
- DNS ASK on####ircvgissrn.sh
- DNS ASK mk#####alduglqtkft.sc
- DNS ASK fr#####elbsvfbbmfiax.cx
- DNS ASK xb######cutgwyqretlfue.so
- DNS ASK cj#####xsbyfgexnafml.mu
- DNS ASK hs####aqukesgnk.ac
- DNS ASK ay####ybsnmuuiq.cm
- DNS ASK nh######kuqwihbjwjdab.cx
- DNS ASK kl###odrhln.tw
