Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'updater' = '"%APPDATA%\updatewidnwos.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'updater' = '"%APPDATA%\updatewidnwos.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lexplorer' = '"%APPDATA%\winhost\lexplorer.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'lexplorer' = '"%APPDATA%\winhost\lexplorer.exe"'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\winhost\lexplorer.exe'
- '%APPDATA%\updatewidnwos.exe'
Modifies file system :
Creates the following files:
- %APPDATA%\updatewidnwos.exe
- %APPDATA%\winhost\lexplorer.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\updatewidnwos.exe
- %APPDATA%\winhost\lexplorer.exe
Network activity:
Connects to:
- 'm5######mj68fljgh4lu16r.tk':80
- 'ly#######2hykh2oa1karb212.tk':80
- '0w#######tw7eonv8acuxwl7p6in.tk':80
- 'qg#####yfsflt8vy7e.tk':80
- 'v7#######wgcqbuyq8hfjym26.tk':80
- '0h#######mfru561bg7jhwbnh6.tk':80
- 'gw######8s1nuiyhnqwdj.tk':80
- 'm2#######w5gprp1jdugobeq3gg.tk':80
- '1w########2w7vgb1fsfhqx2ke7rtxl.tk':80
- 'we########y47kar8513hxh1n428oc.tk':80
- 'h4#####8w0lu2v8tk.tk':80
- '4x######q9bp4cchrgch44.tk':80
- 'yu#######vuasj3wmddcsg2xufyo.tk':80
- 'c8#######3qnniyf1yaq4e30n3k.tk':80
- 'd9#####30c32x544q7.tk':80
- 've######mim6w3hv5kgko6t.tk':80
- 'gc######gdo2ig9lir1wx95i.tk':80
- 'h2#####3j434sqjaq.tk':80
- 'k4######42210bk8q6hm7.tk':80
- 'wp#d':80
- 'wi###os.info':80
- 'yp######awkjpqabuwvpuc6.tk':80
- 'j2########s1b4v8hatir27ac5tgjh.tk':80
- 'gq########ptvxm8irplwwn90dh9e8i.tk':80
- 'am#######a8i7d8alo1ssmmiolvh.tk':80
- '5e########dfu018pj3o0kgd7iuc5.tk':80
- '5x#####fue00p8x7f.tk':80
- 'qm#####emvuehi8d5.tk':80
- '2l######3a4i2q20bjj5wfa.tk':80
TCP:
HTTP GET requests:
- m5######mj68fljgh4lu16r.tk/api?me####################
- ly#######2hykh2oa1karb212.tk/api?me####################
- 0w#######tw7eonv8acuxwl7p6in.tk/api?me####################
- qg#####yfsflt8vy7e.tk/api?me####################
- v7#######wgcqbuyq8hfjym26.tk/api?me####################
- 0h#######mfru561bg7jhwbnh6.tk/api?me####################
- gw######8s1nuiyhnqwdj.tk/api?me####################
- m2#######w5gprp1jdugobeq3gg.tk/api?me####################
- 1w########2w7vgb1fsfhqx2ke7rtxl.tk/api?me####################
- we########y47kar8513hxh1n428oc.tk/api?me####################
- h4#####8w0lu2v8tk.tk/api?me####################
- 4x######q9bp4cchrgch44.tk/api?me####################
- yu#######vuasj3wmddcsg2xufyo.tk/api?me####################
- c8#######3qnniyf1yaq4e30n3k.tk/api?me####################
- d9#####30c32x544q7.tk/api?me####################
- ve######mim6w3hv5kgko6t.tk/api?me####################
- gc######gdo2ig9lir1wx95i.tk/api?me####################
- h2#####3j434sqjaq.tk/api?me####################
- k4######42210bk8q6hm7.tk/api?me####################
- wp#d/wpad.dat
- wi###os.info/api?me####################
- yp######awkjpqabuwvpuc6.tk/api?me####################
- j2########s1b4v8hatir27ac5tgjh.tk/api?me####################
- gq########ptvxm8irplwwn90dh9e8i.tk/api?me####################
- am#######a8i7d8alo1ssmmiolvh.tk/api?me####################
- 5e########dfu018pj3o0kgd7iuc5.tk/api?me####################
- 5x#####fue00p8x7f.tk/api?me####################
- qm#####emvuehi8d5.tk/api?me####################
- 2l######3a4i2q20bjj5wfa.tk/api?me####################
UDP:
- DNS ASK ly#######2hykh2oa1karb212.tk
- DNS ASK m5######mj68fljgh4lu16r.tk
- DNS ASK 4x######q9bp4cchrgch44.tk
- DNS ASK 0w#######tw7eonv8acuxwl7p6in.tk
- DNS ASK 0h#######mfru561bg7jhwbnh6.tk
- DNS ASK v7#######wgcqbuyq8hfjym26.tk
- DNS ASK qg#####yfsflt8vy7e.tk
- DNS ASK gw######8s1nuiyhnqwdj.tk
- DNS ASK we########y47kar8513hxh1n428oc.tk
- DNS ASK 1w########2w7vgb1fsfhqx2ke7rtxl.tk
- DNS ASK ap####y97ygvevfg.tk
- DNS ASK u5#######37nhw22f58q7pqec.tk
- DNS ASK c8#######3qnniyf1yaq4e30n3k.tk
- DNS ASK yu#######vuasj3wmddcsg2xufyo.tk
- DNS ASK m2#######w5gprp1jdugobeq3gg.tk
- DNS ASK h4#####8w0lu2v8tk.tk
- DNS ASK ve######mim6w3hv5kgko6t.tk
- DNS ASK k4######42210bk8q6hm7.tk
- DNS ASK h2#####3j434sqjaq.tk
- DNS ASK gc######gdo2ig9lir1wx95i.tk
- DNS ASK wp#d
- DNS ASK google.com
- DNS ASK yp######awkjpqabuwvpuc6.tk
- DNS ASK wi###os.info
- DNS ASK gq########ptvxm8irplwwn90dh9e8i.tk
- DNS ASK j2########s1b4v8hatir27ac5tgjh.tk
- DNS ASK d9#####30c32x544q7.tk
- DNS ASK am#######a8i7d8alo1ssmmiolvh.tk
- DNS ASK qm#####emvuehi8d5.tk
- DNS ASK 5x#####fue00p8x7f.tk
- DNS ASK 5e########dfu018pj3o0kgd7iuc5.tk
- DNS ASK 2l######3a4i2q20bjj5wfa.tk
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: '(null)'
