Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] '11f86284' = '%APPDATA%\WinSys\coresys.exe'
Modifies file system
Creates the following files
- %APPDATA%\winsys\coresys.exe
- %APPDATA%\winsys\xcoresys.exe
- %APPDATA%\winsys\log.dat
Network activity
Connects to
- 'md#####ndentistry.com':80
- 'gl####abrics.com':80
- 'be####cor.com.br':80
- 'lo###ixels.com':80
- 'lo###ixels.com':443
- 'ci#####a.wimex.com.ua':80
- 'ch#####tworecords.com':80
- 'ca###olt.org':80
- 'so####eaenergy.com':80
- 'so####eaenergy.com':443
- 'to####obuynsell.com':80
- 'google.com':443
- 'pk#.goog':80
TCP
HTTP GET requests
- http://www.to####obuynsell.com/wp-content/plugins/WPSecurity/load.php
- http://pk#.goog/gsr1/gsr1.crt
HTTP POST requests
- http://md#####ndentistry.com/wp-content/plugins/WPSecurity/load.php
- http://www.be####cor.com.br/wp-content/plugins/WPSecurity/load.php
- http://lo###ixels.com/wp-content/plugins/WPSecurity/load.php
- http://ch#####tworecords.com/wp-content/plugins/WPSecurity/load.php
- http://ca###olt.org/wp-content/plugins/WPSecurity/load.php
- http://www.so####eaenergy.com/wp-content/plugins/WPSecurity/load.php
- http://to####obuynsell.com/wp-content/plugins/WPSecurity/load.php
Other
- 'lo###ixels.com':443
- 'so####eaenergy.com':443
- 'google.com':443
UDP
- DNS ASK md#####ndentistry.com
- DNS ASK gl####abrics.com
- DNS ASK be####cor.com.br
- DNS ASK bl##.####.serowarpodlaski.pl
- DNS ASK lo###ixels.com
- DNS ASK ci#####a.wimex.com.ua
- DNS ASK ch#####tworecords.com
- DNS ASK ca###olt.org
- DNS ASK so####eaenergy.com
- DNS ASK to####obuynsell.com
- DNS ASK google.com
- DNS ASK pk#.goog
Miscellaneous
Creates and executes the following
- '%APPDATA%\winsys\coresys.exe'
- '%APPDATA%\winsys\xcoresys.exe' --CLIPS
- '%APPDATA%\winsys\xcoresys.exe' --CLIPSS
- '%APPDATA%\winsys\xcoresys.exe' --WALLS
- '%APPDATA%\winsys\xcoresys.exe' --PARSE
- '%APPDATA%\winsys\xcoresys.exe' --BRUTE
- '%WINDIR%\syswow64\cmd.exe' /c type "<Full path to file>" > "%APPDATA%\WinSys\coresys.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c type "<Full path to file>" > "%APPDATA%\WinSys\xcoresys.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c pushd %APPDATA%\WinSys & start coresys.exe & popd' (with hidden window)
- '%APPDATA%\winsys\xcoresys.exe' --CLIPS' (with hidden window)
- '%APPDATA%\winsys\xcoresys.exe' --CLIPSS' (with hidden window)
- '%APPDATA%\winsys\xcoresys.exe' --WALLS' (with hidden window)
- '%APPDATA%\winsys\xcoresys.exe' --PARSE' (with hidden window)
- '%APPDATA%\winsys\xcoresys.exe' --BRUTE' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c type "<Full path to file>" > "%APPDATA%\WinSys\coresys.exe"
- '%WINDIR%\syswow64\cmd.exe' /c type "<Full path to file>" > "%APPDATA%\WinSys\xcoresys.exe"
- '%WINDIR%\syswow64\cmd.exe' /c pushd %APPDATA%\WinSys & start coresys.exe & popd
