Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Creates onion service
Modifies file system
Creates the following files
- %TEMP%\mz_etilqs_v8fqxeg5rgbkbou
- %TEMP%\mz_etilqs_tywcscdsm15uvio
- %TEMP%\mz_etilqs_fxajc0pdheagwkl
- %TEMP%\mz_etilqs_hsakdgy3jablgcy
- %APPDATA%\tor\state.tmp
- %TEMP%\opencl.dll
- %APPDATA%\tor\hidden_service\private_key.tmp
- %APPDATA%\tor\hidden_service\hostname.tmp
- %APPDATA%\ikyh\fowy.exe
Moves the following files
- from %APPDATA%\tor\state.tmp to %APPDATA%\tor\state
- from %APPDATA%\tor\hidden_service\private_key.tmp to %APPDATA%\tor\hidden_service\private_key
- from %APPDATA%\tor\hidden_service\hostname.tmp to %APPDATA%\tor\hidden_service\hostname
Deletes itself.
Network activity
Connects to
- '34.##0.144.191':443
- 'fe########alog-cdn.prod.mozaws.net':443
- 'ch####p.dyndns.org':80
- 'localhost':49197
- 'localhost':9050
- '12#.31.0.39':9101
TCP
HTTP GET requests
- http://ch####p.dyndns.org/
Other
- '34.##0.144.191':443
- 'localhost':9050
- 'localhost':49200
- 'localhost':49199
- 'localhost':49201
UDP
- DNS ASK fe########alog-cdn.prod.mozaws.net
- DNS ASK ch####p.dyndns.org
Miscellaneous
Creates and executes the following
- '%APPDATA%\ikyh\fowy.exe'
- '<Full path to file>' ' (with hidden window)
- '%ProgramFiles(x86)%\opera\launcher.exe' ext "<Full path to file>"' (with hidden window)
- '%ProgramFiles(x86)%\opera\launcher.exe' "ext" "<Full path to file>"' (with hidden window)
- '%WINDIR%\syswow64\svchost.exe' ext "<Full path to file>"' (with hidden window)
- '%ProgramFiles(x86)%\opera\launcher.exe' --HiddenServiceDir "%APPDATA%\tor\hidden_service" --HiddenServicePort "55080 127.0.0.1:55080"' (with hidden window)
- '%APPDATA%\ikyh\fowy.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\tmpe12cbf40.bat"' (with hidden window)
- '%ProgramFiles(x86)%\opera\launcher.exe' ext "%APPDATA%\Ikyh\fowy.exe"' (with hidden window)
Executes the following
- '%ProgramFiles(x86)%\opera\launcher.exe' ext "<Full path to file>"
- '%ProgramFiles(x86)%\opera\launcher.exe' "ext" "<Full path to file>"
- '%WINDIR%\syswow64\svchost.exe' ext "<Full path to file>"
- '%ProgramFiles(x86)%\opera\launcher.exe' --HiddenServiceDir "%APPDATA%\tor\hidden_service" --HiddenServicePort "55080 127.0.0.1:55080"
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\tmpe12cbf40.bat"
- '%ProgramFiles(x86)%\opera\launcher.exe' ext "%APPDATA%\Ikyh\fowy.exe"
