Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MhrHcrji' = '<LS_APPDATA>\ebaurodr\mhrhcrji.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,<LS_APPDATA>\ebaurodr\mhrhcrji.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\mhrhcrji.exe
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Micorsoft Windows Service] 'ImagePath' = '%TEMP%\tssofofu.sys'
Malicious functions:
Creates and executes the following:
- '%TEMP%\empchqloliakgweu.exe'
Executes the following:
- '%TEMP%\empchqloliakgweu.exe'
- '<SYSTEM32>\svchost.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtOpenKey, handler: tssofofu.sys
- NtCreateKey, handler: tssofofu.sys
Modifies file system:
Creates the following files:
- %TEMP%\tssofofu.sys
- %WINDIR%\Temp\6decd52f
- %WINDIR%\Temp\7fffffb1
- %TEMP%\empchqloliakgweu.exe
- <LS_APPDATA>\niuydqre.log
- <LS_APPDATA>\ebaurodr\mhrhcrji.exe
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\mhrhcrji.exe
Deletes the following files:
- %TEMP%\tssofofu.sys
Network activity:
Connects to:
- 'gs#####jtfhhynbqep.com':443
- 'ck####ltviespq.com':443
- 'oo####ayvbmwj.com':443
- 'dh#####lkkfjvchbos.com':443
- 'ww####oqwcodyhg.com':443
- 'wk###spswbf.com':443
- 'mb#####qkbfmhhsbh.com':443
- '74.##5.232.51':80
- 'hc####rivnuq.com':443
- 'ka#####ogsgfcuhqbu.com':443
- 'ry#####fgeouuwkgmys.com':443
UDP:
- DNS ASK da####ajbaruitl.com
- DNS ASK px###cdw.com
- DNS ASK ky####hcggxeci.com
- DNS ASK sj#####kqqpnglnxeuy.com
- DNS ASK hu###isdcb.com
- DNS ASK yn####gabbuih.com
- DNS ASK ii####icoaoeq.com
- DNS ASK hv####sgosll.com
- DNS ASK rt###reg.com
- DNS ASK sm#####ybkqxgggxi.com
- DNS ASK ap###chhvd.com
- DNS ASK pn#####iemjvbdif.com
- DNS ASK qi####rikjxm.com
- DNS ASK ac###dbfibi.com
- DNS ASK df####ojxqdvpok.com
- DNS ASK ox###txusq.com
- DNS ASK mo#####ljwkystfr.com
- DNS ASK vh#####jvkrrpaoreh.com
- DNS ASK jv#####ufntnnxclbpv.com
- DNS ASK ox###hkvjf.com
- DNS ASK yw###mld.com
- DNS ASK pj#####ocueeaptsl.com
- DNS ASK bing.com
- DNS ASK jd###fuf.com
- DNS ASK om#####yapdirqvquph.com
- DNS ASK so#####gabyqofac.com
- DNS ASK yn#####shgpdrvvi.com
- DNS ASK ba####ltopytrr.com
- DNS ASK un#####jmnhnnghnw.com
- DNS ASK bk####swfleuvcn.com
- DNS ASK vd#####vwepovavhcu.com
- DNS ASK pv####whjdsql.com
- DNS ASK gp####kgpysvrgi.com
- DNS ASK hp#####axleylunft.com
- DNS ASK uq#####agkhesefeje.com
- DNS ASK kl#####jacuujdmi.com
- DNS ASK nj###cnew.com
- DNS ASK ys####khthspimi.com
- DNS ASK wt####picsawwrg.com
- DNS ASK bg####ykkgyrswt.com
- DNS ASK lm#####rhrbkjpjm.com
- DNS ASK fk###tbip.com
- DNS ASK dh#####lkkfjvchbos.com
- DNS ASK ca#####gvacsmjvdeo.com
- DNS ASK gk###sfp.com
- DNS ASK pb#####ggeshensvai.com
- DNS ASK ye#####xusokritv.com
- DNS ASK xh####jyyixvkkv.com
- DNS ASK rx#####mfajodqpya.com
- DNS ASK ww####oqwcodyhg.com
- DNS ASK hc####rivnuq.com
- DNS ASK ry#####fgeouuwkgmys.com
- DNS ASK google.com
- DNS ASK mb#####qkbfmhhsbh.com
- DNS ASK ka#####ogsgfcuhqbu.com
- DNS ASK gs#####jtfhhynbqep.com
- DNS ASK oo####ayvbmwj.com
- DNS ASK wk###spswbf.com
- DNS ASK ck####ltviespq.com
- DNS ASK gc####dnytfex.com
- DNS ASK pa####ukffbagn.com
- DNS ASK cu###tnwlm.com
- DNS ASK ty####tygvteg.com
- DNS ASK wb####hqckinimw.com
- DNS ASK eb####satalkn.com
- DNS ASK mq#####ovyjmwqqbh.com
- DNS ASK uq#####csipiblph.com
- DNS ASK xd###ipkq.com
- DNS ASK on#####ydxikojfhfy.com
- DNS ASK kh#####tlstoevnry.com
- DNS ASK vm#####eixksivixx.com
- DNS ASK sk###rtjva.com
- DNS ASK py####csqeqnmvh.com
- DNS ASK ws####nckmmev.com
- DNS ASK dt####slyjatusl.com
- DNS ASK ke###lvv.com
- DNS ASK gd#####ibdnckcit.com
- DNS ASK ia###hrcy.com
- DNS ASK sg####kwdhkcju.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
