Win32.HLLW.Autoruner1.28054

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '<LS_APPDATA>\f5a698ed\X'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\f5a698ed] 'ImagePath' = '%WINDIR%\3986204405:173631250.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\.<Auxiliary name>] 'ImagePath' = '\?'

Malicious functions:

Creates and executes the following:

'%WINDIR%\3986204405:173631250.exe'
'<LS_APPDATA>\f5a698ed\X'

Executes the following:

'%WINDIR%\explorer.exe'

Injects code into

the following system processes:

<SYSTEM32>\winlogon.exe
%WINDIR%\Explorer.EXE

Modifies file system :

Creates the following files:

%WINDIR%\$NtUninstallKB37556$\4121336045\L\alehhooo
%WINDIR%\$NtUninstallKB37556$\4121336045\@
%WINDIR%\3986204405:173631250.exe
<LS_APPDATA>\f5a698ed\@
<LS_APPDATA>\f5a698ed\X

Deletes itself.

Network activity:

Connects to:

'17#.#6.224.235':21810
'10#.#65.67.63':21810
'41.##4.212.47':21810
'2.##.234.180':21810
'92.##5.46.62':21810
'86.##2.244.51':21810
'17#.#5.18.79':21810
'89.##9.149.5':21810
'17#.#7.89.104':21810
'85.##.189.34':21810
'18#.#86.103.230':21810
'46.##0.85.170':21810
'17#.#04.172.146':21810
'89.##.103.217':21810
'94.##7.205.169':21810
'18#.#87.171.86':21810
'94.#0.98.79':21810
'95.#9.70.51':21810
'78.##.65.189':21810
'85.##3.106.206':21810
'17#.#5.101.46':21810
'18#.#86.83.177':21810
'77.##8.209.186':21810
'12#.#37.54.10':21810
'95.##1.172.230':21810
'82.##9.82.189':21810
'17#.#5.27.208':21810
'18#.#42.89.57':21810
'80.##.158.49':21810
'31.##3.113.129':21810
'95.##6.124.79':21810
'1.##.193.247':21810
'94.##0.185.228':21810
'18#.#4.229.144':21810
'18#.#68.7.88':21810
'94.##1.175.165':21810
'17#.#1.46.246':21810
'46.##3.206.13':21810
'17#.#29.91.150':21810
'31.##8.97.82':21810
'95.#3.88.74':21810
'18#.#9.131.45':21810
'2.##9.0.129':21810
'84.##.253.84':21810
'87.##0.201.253':21810
'95.##.108.209':21810
'90.##3.206.177':21810
'85.##6.196.187':21810
'95.#8.46.56':21810
'21#.#2.73.226':21810
'13#.#56.73.101':21810
'83.##9.155.31':21810
'46.##8.200.126':21810
'94.##2.12.116':21810
'19#.#09.118.81':21810
'92.##6.185.47':21810
'18#.#34.92.171':21810
'84.##.157.231':21810
'18#.#15.196.22':21810
'85.##0.121.17':21810
'82.##9.211.171':21810
'21#.#04.94.96':21810
'31.##.250.204':21810
'79.##5.253.89':21810
'46.##1.166.158':21810
'46.##3.88.67':21810
'18#.#32.54.132':21810
'87.##4.54.67':21810
'21#.#89.214.11':21810
'86.#26.9.36':21810
'13#.#30.131.105':21810
'24.##2.74.73':21810
'99.##.183.49':21810
'17#.#41.99.171':21810
'89.##.124.228':21810
'11#.#05.69.14':21810
'91.##.125.163':21810
'17#.45.5.98':21810
'84.##.28.147':21810
'58.##.161.140':21810
'89.##7.99.117':21810
'93.##6.26.191':21810
'98.#0.53.46':21810
'12#.#5.86.22':21810
'20#.#0.103.183':21810
'80.##.114.65':21810
'12#.#37.89.129':21810
'31.#.113.21':21810
'18#.#98.58.100':21810
'79.##4.247.243':21810
'41.##7.67.111':21810
'21#.#28.22.173':21810
'12#.#60.147.190':21810
'92.##8.16.80':21810
'13#.#56.141.74':21810
'94.##3.14.133':21810
'2.##.180.161':21810
'79.##4.156.28':21810
'11#.#42.129.30':21810
'82.##1.50.172':21810
'46.##7.190.218':21810
'13#.#47.2.200':21810
'18#.#78.171.3':21810
'18#.16.4.19':21810
'11#.#2.244.94':21810
'46.##3.215.154':21810
'93.##.142.213':21810
'10#.#37.104.224':21810
'77.#8.185.3':21810
'17#.#09.234.79':21810
'79.##4.54.10':21810
'83.#.199.127':21810
'21#.#1.72.29':21810
'79.##6.81.133':21810
'17#.#7.144.130':21810
'89.##7.234.245':21810
'18#.#88.231.46':21810
'17#.#4.240.59':21810
'18#.#68.72.12':21810
'21#.#92.95.222':21810
'95.##9.137.97':21810
'17#.#55.89.125':21810
'10#.#69.235.97':21810
'46.##9.143.103':21810
'12#.#7.121.252':21810
'18#.#5.62.195':21810
'21#.#6.250.69':21810
'49.##5.106.117':21810
'10#.#87.77.125':21810
'78.##6.90.239':21810
'46.##2.52.65':21810
'68.#4.19.44':21810
'85.##1.150.84':21810
'79.##2.137.44':21810
'12#.#.76.115':21810
'20#.#01.87.126':21810
'49.##3.49.189':21810
'93.##5.93.156':21810
'12#.#9.91.56':21810
'11#.#42.44.162':21810
'31.##.115.224':21810
'89.##5.137.127':21810
'78.##.75.122':21810
'82.##3.67.116':21810
'78.#.122.106':21810
'46.##1.214.188':21810
'11#.#97.225.187':21810
'21#.#7.175.196':21810
'85.##.222.54':21810
'95.##.85.180':21810
'59.##5.53.88':21810
'17#.#87.172.104':21810
'85.##2.189.37':21810
'20#.#3.36.129':21810
'94.##0.194.195':21810
'11#.#42.153.136':21810
'11#.#54.10.116':21810
'11#.#7.79.246':21810
'11#.#00.17.17':21810
'21#.#9.45.55':21810
'10#.#9.223.107':21810
'22#.#8.161.191':21810
'19#.#05.135.219':21810
'17#.#04.141.236':21810
'92.##6.34.197':21810
'21#.#2.187.124':21810
'18#.#91.158.131':21810
'79.##5.121.128':21810
'46.##9.122.204':21810
'11#.#99.254.202':21810
'77.##.228.137':21810
'19#.#05.154.210':80
'21#.#64.154.10':21810
'19#.#62.36.61':21810
'21#.#9.112.40':21810
'12#.#9.219.194':21810
'19#.#53.140.93':21810
'21#.#7.157.60':21810
'18#.#6.166.13':21810
'18#.#86.92.6':21810
'10#.#94.229.74':21810
'80.##.96.234':21810
'46.##0.81.36':21810
'59.##.172.153':21810
'19#.#2.102.125':21810
'93.##4.102.93':21810
'95.##.116.127':21810
'95.##3.105.220':21810
'77.##8.227.215':21810
'89.#6.67.89':21810
'11#.#1.77.45':21810
'20#.#25.118.159':21810
'18#.#6.210.45':21810
'95.##.93.122':21810
'11#.#5.132.37':21810
'93.##3.226.240':21810
'83.##0.90.133':21810
'75.##.184.59':21810
'11#.#53.229.253':21810
'46.#.52.243':21810
'46.##3.36.246':21810
'95.##9.218.117':21810
'79.##4.72.249':21810
'12#.#7.210.101':21810
'82.##2.13.88':21810
'11#.#14.53.82':21810
'94.##.46.114':21810
'12#.#41.128.249':21810
'94.##.135.73':21810
'79.##5.42.244':21810
'93.##8.72.199':21810
'46.##6.153.149':21810
'94.##1.211.49':21810
'77.##8.208.227':21810
'14.##4.54.153':21810
'10#.#95.185.57':21810
'10#.#91.167.125':21810
'<Private IP address>':21810
'94.##3.16.82':21810
'11#.#19.200.217':21810
'20#.#62.191.140':21810
'81.##.107.74':21810
'13#.#99.157.202':21810
'17#.#2.130.73':21810
'27.#.146.154':21810
'92.##4.32.100':21810
'89.##.228.238':21810
'80.##.30.218':21810
'95.##.23.162':21810
'46.##2.112.87':21810
'95.#4.67.18':21810
'79.##4.242.139':21810
'11#.#8.168.227':21810
'10#.#05.164.136':21810
'94.##2.136.68':21810
'17#.#04.140.26':21810
'21#.13.4.4':21810
'46.##.251.206':21810
'17#.#29.30.78':21810
'95.#6.48.72':21810
'10#.#25.0.33':21810
'90.##1.140.49':21810
'79.##2.10.186':21810
'18#.#15.81.42':21810
'59.##7.137.143':21810
'59.##.243.255':21810
'95.##.17.109':21810
'80.##4.102.68':21810
'11#.#42.12.122':21810
'17#.#22.164.81':21810
'94.##2.157.53':21810
'92.#1.2.147':21810
'11#.#8.80.55':21810
'82.##2.45.204':21810
'77.##1.151.60':21810
'79.##4.75.25':21810
'49.##1.187.210':21810

TCP:

HTTP GET requests:

19#.#05.154.210/bad.php?w=###################################################
19#.#05.154.210/stat2.php?w=################################################
19#.#05.154.210/stat2.php?w=#################################################

Tecnologías

Términos

Formación y educación

Mitos

Technical Information