Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\syshost32] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\syshost32] 'ImagePath' = '"%WINDIR%\Installer\{6C1A2535-BB0C-B67F-10C6-7A93F0AEC45D}\syshost.exe" /service'
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall set rule name="Core Networking - System IP Core" dir=in new action=allow enable=yes profile=any
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Core Networking - System IP Core" dir=in action=allow enable=yes profile=any
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall set rule name="Core Networking - System IP Core" dir=out new action=allow enable=yes profile=any
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Core Networking - System IP Core" dir=out action=allow enable=yes profile=any
Modifies file system
Creates the following files
- %WINDIR%\installer\{6c1a2535-bb0c-b67f-10c6-7a93f0aec45d}\syshost.exe
Moves itself
- from <Full path to file> to %TEMP%\73b6de06.tmp
Deletes itself.
Network activity
Connects to
- 'fa###ook.com':80
UDP
- DNS ASK fa###ook.com
- DNS ASK wk####ggvsjnfvm.com
- DNS ASK ep###fjfpi.com
- DNS ASK gj####qncxord.com
- DNS ASK mg###aldqo.com
- DNS ASK 0.###l.ntp.org
- DNS ASK 1.###l.ntp.org
- DNS ASK 2.###l.ntp.org
- DNS ASK me###hara.bit
- '0.###l.ntp.org':123
- '1.###l.ntp.org':123
- '2.###l.ntp.org':123
Miscellaneous
Creates and executes the following
- '%WINDIR%\installer\{6c1a2535-bb0c-b67f-10c6-7a93f0aec45d}\syshost.exe' /service
- '%WINDIR%\syswow64\cmd.exe' /C del /Q /F "%TEMP%\73b6de06.tmp"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall set rule name="Core Networking - System IP Core" dir=in new action=allow enable=yes profile=any' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Core Networking - System IP Core" dir=in action=allow enable=yes profile=any' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall set rule name="Core Networking - System IP Core" dir=out new action=allow enable=yes profile=any' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Core Networking - System IP Core" dir=out action=allow enable=yes profile=any' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C del /Q /F "%TEMP%\73b6de06.tmp"
