Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\syshost32] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\syshost32] 'ImagePath' = '"%WINDIR%\Installer\{32B3E5AD-BBC9-E031-31BD-008711ABE5D3}\syshost.exe" /service'
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Creates the following services
- 'syshost32' "%WINDIR%\Installer\{32B3E5AD-BBC9-E031-31BD-008711ABE5D3}\syshost.exe" /service
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall set rule name="Core Networking - System IP Core" dir=in new action=allow enable=yes profile=any
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Core Networking - System IP Core" dir=in action=allow enable=yes profile=any
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall set rule name="Core Networking - System IP Core" dir=out new action=allow enable=yes profile=any
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Core Networking - System IP Core" dir=out action=allow enable=yes profile=any
Modifies file system
Creates the following files
- %WINDIR%\installer\{32b3e5ad-bbc9-e031-31bd-008711abe5d3}\syshost.exe
- %WINDIR%\temp\ed0c884a-6dfe-eb23-8182-feeff5418f57.tmp
Moves itself
- from <Full path to file> to %TEMP%\6a2adf26.tmp
Deletes itself.
Network activity
TCP
HTTP POST requests
- http://35.##8.227.183/forum/db.php
UDP
- DNS ASK microsoft.com
- DNS ASK np###hmoru.biz
- DNS ASK 1.###l.ntp.org
- DNS ASK 0.###l.ntp.org
- DNS ASK 2.###l.ntp.org
- DNS ASK fn###domqg.com
- DNS ASK ae####klqrsey.com
- DNS ASK qm###haqbnj.com
- DNS ASK dj####neadxkz.com
- '14#.#4.167.130':22939
- '1.###l.ntp.org':123
- '19#.#7.98.16':12960
- '2.###l.ntp.org':123
- '18#.89.72.7':21982
- '20#.#27.85.122':20800
- '15#.#85.86.99':11905
- '85.##7.237.246':16766
- '18#.#66.195.18':31719
- '0.###l.ntp.org':123
- '18#.#9.50.83':21625
Miscellaneous
Creates and executes the following
- '%WINDIR%\installer\{32b3e5ad-bbc9-e031-31bd-008711abe5d3}\syshost.exe' /service
- '%WINDIR%\syswow64\cmd.exe' /C del /Q /F "%TEMP%\6a2adf26.tmp"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall set rule name="Core Networking - System IP Core" dir=in new action=allow enable=yes profile=any' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Core Networking - System IP Core" dir=in action=allow enable=yes profile=any' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall set rule name="Core Networking - System IP Core" dir=out new action=allow enable=yes profile=any' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Core Networking - System IP Core" dir=out action=allow enable=yes profile=any' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C del /Q /F "%TEMP%\6a2adf26.tmp"
