Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WindHost' = '%APPDATA%\temp\WindHost.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe ,%APPDATA%\<Virus name>.exe'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\temp\UFASoft.exe' /pid=4448
- '%APPDATA%\temp\UFASoft.exe' /pid=5276
- '%APPDATA%\temp\UFASoft.exe' /pid=4588
- '%APPDATA%\temp\UFASoft.exe' /pid=4816
- '%APPDATA%\temp\UFASoft.exe' /pid=5476
- '%APPDATA%\temp\UFASoft.exe' /pid=5596
- '%APPDATA%\temp\UFASoft.exe' /pid=5288
- '%APPDATA%\temp\UFASoft.exe' /pid=4748
- '%APPDATA%\temp\UFASoft.exe' /pid=2408
- '%APPDATA%\temp\UFASoft.exe' /pid=4956
- '%APPDATA%\temp\UFASoft.exe' /pid=5916
- '%APPDATA%\temp\UFASoft.exe' /pid=6048
- '%APPDATA%\temp\UFASoft.exe' /pid=5728
- '%APPDATA%\temp\UFASoft.exe' /pid=5776
- '%APPDATA%\temp\UFASoft.exe' /pid=428
- '%APPDATA%\temp\UFASoft.exe' /pid=2060
- '%APPDATA%\temp\UFASoft.exe' /pid=4344
- '%APPDATA%\temp\UFASoft.exe' /pid=2688
- '%APPDATA%\temp\UFASoft.exe' /pid=4384
- '%APPDATA%\temp\UFASoft.exe' /pid=5628
- '%APPDATA%\temp\UFASoft.exe' /pid=3988
- '%APPDATA%\temp\UFASoft.exe' /pid=4836
- '%APPDATA%\temp\UFASoft.exe' /pid=6068
- '%APPDATA%\temp\UFASoft.exe' /pid=6012
- '%APPDATA%\temp\UFASoft.exe' /pid=6136
- '%APPDATA%\temp\UFASoft.exe' /pid=3568
- '%APPDATA%\temp\UFASoft.exe' /pid=4756
- '%APPDATA%\temp\UFASoft.exe' /pid=5952
- '%APPDATA%\temp\UFASoft.exe' /pid=4392
- '%APPDATA%\temp\UFASoft.exe' /pid=5852
- '%APPDATA%\temp\UFASoft.exe' /pid=2840
- '%APPDATA%\temp\UFASoft.exe' /pid=3156
- '%APPDATA%\temp\UFASoft.exe' /pid=3976
- '%APPDATA%\temp\UFASoft.exe' /pid=5848
- '%APPDATA%\temp\UFASoft.exe' /pid=3056
- '%APPDATA%\temp\UFASoft.exe' /pid=4536
- '%APPDATA%\temp\UFASoft.exe' /pid=4668
- '%APPDATA%\temp\UFASoft.exe' /pid=5016
- '%APPDATA%\temp\UFASoft.exe' /pid=4292
- '%APPDATA%\temp\UFASoft.exe' /pid=2784
- '%APPDATA%\temp\UFASoft.exe' /pid=3308
- '%APPDATA%\temp\UFASoft.exe' /pid=500
- '%APPDATA%\temp\UFASoft.exe' /pid=3048
- '%APPDATA%\temp\UFASoft.exe' /pid=4204
- '%APPDATA%\temp\UFASoft.exe' /pid=4468
- '%APPDATA%\temp\UFASoft.exe' /pid=4688
- '%APPDATA%\temp\UFASoft.exe' /pid=4284
- '%APPDATA%\temp\UFASoft.exe' /pid=4364
- '%APPDATA%\temp\UFASoft.exe' /pid=316
- '%APPDATA%\temp\UFASoft.exe' /pid=2536
- '%APPDATA%\temp\UFASoft.exe' -a sha256 -g no -o pool.50btc.com:8332 -u skydaddyhacks@aol.com -p imirish90 -t 8
- '%APPDATA%\temp\UFASoft.exe' /pid=2416
- '%APPDATA%\temp\UFASoft.exe' /pid=3160
- '%APPDATA%\temp\UFASoft.exe' /pid=2672
- '%APPDATA%\temp\UFASoft.exe' /pid=3404
- '%APPDATA%\temp\UFASoft.exe' /pid=3360
- '%APPDATA%\temp\UFASoft.exe' /pid=3572
- '%APPDATA%\temp\UFASoft.exe' /pid=4768
- '%APPDATA%\temp\UFASoft.exe' /pid=4048
- '%APPDATA%\temp\UFASoft.exe' /pid=4556
- '%APPDATA%\temp\UFASoft.exe' /pid=3248
- '%APPDATA%\temp\UFASoft.exe' /pid=3384
- '%APPDATA%\temp\UFASoft.exe' /pid=4928
- '%APPDATA%\temp\UFASoft.exe' /pid=5516
- '%APPDATA%\temp\UFASoft.exe' /pid=5636
- '%APPDATA%\temp\UFASoft.exe' /pid=5156
- '%APPDATA%\temp\UFASoft.exe' /pid=5556
- '%APPDATA%\temp\UFASoft.exe' /pid=5608
- '%APPDATA%\temp\UFASoft.exe' /pid=5892
- '%APPDATA%\temp\UFASoft.exe' /pid=5308
- '%APPDATA%\temp\UFASoft.exe' /pid=4868
- '%APPDATA%\temp\UFASoft.exe' /pid=5208
- '%APPDATA%\temp\UFASoft.exe' /pid=3548
- '%APPDATA%\temp\UFASoft.exe' /pid=2976
- '%APPDATA%\temp\UFASoft.exe' /pid=6132
- '%APPDATA%\temp\UFASoft.exe' /pid=5908
- '<SYSTEM32>\cmd.exe' (downloaded from the Internet)
- '%APPDATA%\temp\UFASoft.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\attrib.exe' /pid=3652
- '<SYSTEM32>\attrib.exe' -s -h %APPDATA%\temp
- '<SYSTEM32>\wscript.exe' "%TEMP%\mic.vbs"
Injects code into
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system :
Creates the following files:
- %APPDATA%\temp\btc.il
- %APPDATA%\temp\btc-evergreen.il
- %APPDATA%\temp\bdb.dll
- %TEMP%\304E3.dmp
- %APPDATA%\temp\UFASoft.exe
- %APPDATA%\temp\phatk.ptx
- %APPDATA%\temp\usft_ext.dll
- %APPDATA%\temp\phatk.cl
- %APPDATA%\temp\coinutil.dll
- %APPDATA%\temp\miner.dll
- %TEMP%\mic.vbs
- %TEMP%\dw.log
- %APPDATA%\<Virus name>.exe:Zone.Identifier
- <Full path to virus>:Zone.Identifier
- %APPDATA%\<Virus name>.exe
- %TEMP%\30B1D.dmp
- %TEMP%\30C17.dmp
- %TEMP%\30909.dmp
- %TEMP%\30437.dmp
- %TEMP%\3059E.dmp
Sets the 'hidden' attribute to the following files:
- <Full path to virus>
Deletes the following files:
- %TEMP%\mic.vbs
Moves itself:
- from <Full path to virus> to %APPDATA%\temp\WindHost.exe
Network activity:
Connects to:
- '19#.#3.167.160':80
- 'wp#d':80
TCP:
HTTP GET requests:
- 19#.#3.167.160/sov1001/miner.dll
- 19#.#3.167.160/sov1001/coinutil.dll
- 19#.#3.167.160/sov1001/phatk.cl
- 19#.#3.167.160/sov1001/usft_ext.dll
- 19#.#3.167.160/sov1001/phatk.ptx
- 19#.#3.167.160/sov1001/coin-miner.exe
- wp#d/wpad.dat
- 19#.#3.167.160/sov1001/bdb.dll
- 19#.#3.167.160/sov1001/btc-evergreen.il
- 19#.#3.167.160/sov1001/btc.il
UDP:
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
