Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '93f7981' = '%APPDATA%\Roaming\93f7981.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] '*3f7981' = '%APPDATA%\Roaming\93f7981.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '93f798' = 'C:\93f7981\93f7981.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] '*3f798' = 'C:\93f7981\93f7981.exe'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
Executes the following:
- '<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\svchost.exe' -k swprv
- '<SYSTEM32>\bcdedit.exe' /set {default} recoveryenabled No
- '%WINDIR%\explorer.exe'
- '<SYSTEM32>\svchost.exe' netsvcs
- '<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
- %WINDIR%\explorer.exe
Modifies file system :
Creates the following files:
- %APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93f7981.exe
- %APPDATA%\Roaming\93f7981.exe
- C:\93f7981\93f7981.exe
Network activity:
Connects to:
- 'ni###hnih.com':80
- 'ug##key.com':80
- 'br####sposter.com':80
- 'sw###intin.com':80
- 'cr###atsp.com':80
TCP:
HTTP POST requests:
- br####sposter.com/gi58d0sp4jiul
- ni###hnih.com/gi58d0sp4jiul
- ug##key.com/gi58d0sp4jiul
- ug##key.com/9978h838weuc5e7
- sw###intin.com/gi58d0sp4jiul
- cr###atsp.com/gi58d0sp4jiul
- ni###hnih.com/ulstntrnlz6
- ug##key.com/ulstntrnlz6
- sw###intin.com/9b019pgdnvdww9
- sw###intin.com/ulstntrnlz6
- cr###atsp.com/ulstntrnlz6
- br####sposter.com/ulstntrnlz6
- ni###hnih.com/9978h838weuc5e7
- ug##key.com/i7lwa5d6fc0k
- sw###intin.com/cdtkzu9n2tqch1
- cr###atsp.com/cdtkzu9n2tqch1
- cr###atsp.com/i7lwa5d6fc0k
- br####sposter.com/i7lwa5d6fc0k
- ni###hnih.com/i7lwa5d6fc0k
- sw###intin.com/9978h838weuc5e7
- cr###atsp.com/9978h838weuc5e7
- br####sposter.com/9978h838weuc5e7
- br####sposter.com/cdtkzu9n2tqch1
- ni###hnih.com/cdtkzu9n2tqch1
- ug##key.com/cdtkzu9n2tqch1
- cr###atsp.com/9b019pgdnvdww9
- ni###hnih.com/l3hrfcr6cgg
- ug##key.com/l3hrfcr6cgg
- sw###intin.com/0232npmi26h6
- sw###intin.com/l3hrfcr6cgg
- cr###atsp.com/l3hrfcr6cgg
- br####sposter.com/l3hrfcr6cgg
- ug##key.com/0232npmi26h6
- sw###intin.com/n3g14i359d0n570
- cr###atsp.com/n3g14i359d0n570
- cr###atsp.com/0232npmi26h6
- br####sposter.com/0232npmi26h6
- ni###hnih.com/0232npmi26h6
- ug##key.com/j88nw6x32qj5f9a
- sw###intin.com/83oyrrrlqywxy
- cr###atsp.com/83oyrrrlqywxy
- br####sposter.com/83oyrrrlqywxy
- br####sposter.com/9b019pgdnvdww9
- ni###hnih.com/9b019pgdnvdww9
- ug##key.com/9b019pgdnvdww9
- cr###atsp.com/j88nw6x32qj5f9a
- br####sposter.com/j88nw6x32qj5f9a
- ni###hnih.com/j88nw6x32qj5f9a
- ni###hnih.com/83oyrrrlqywxy
- ug##key.com/83oyrrrlqywxy
- sw###intin.com/j88nw6x32qj5f9a
- cr###atsp.com/wgfn5glfpf
- br####sposter.com/wgfn5glfpf
- ni###hnih.com/wgfn5glfpf
- ni###hnih.com/rpahmf6t2i5yu4a
- ug##key.com/rpahmf6t2i5yu4a
- sw###intin.com/wgfn5glfpf
- br####sposter.com/lm5gr18enj
- ni###hnih.com/lm5gr18enj
- ug##key.com/lm5gr18enj
- ug##key.com/wgfn5glfpf
- sw###intin.com/lm5gr18enj
- cr###atsp.com/lm5gr18enj
- br####sposter.com/rpahmf6t2i5yu4a
- ni###hnih.com/tycvgt6hszzc
- ug##key.com/tycvgt6hszzc
- sw###intin.com/vd3w4gd726is4wg
- sw###intin.com/tycvgt6hszzc
- cr###atsp.com/tycvgt6hszzc
- br####sposter.com/tycvgt6hszzc
- ug##key.com/vd3w4gd726is4wg
- sw###intin.com/rpahmf6t2i5yu4a
- cr###atsp.com/rpahmf6t2i5yu4a
- cr###atsp.com/vd3w4gd726is4wg
- br####sposter.com/vd3w4gd726is4wg
- ni###hnih.com/vd3w4gd726is4wg
- sw###intin.com/63jdrxnyqas
- br####sposter.com/09n71kly53
- ni###hnih.com/09n71kly53
- ug##key.com/09n71kly53
- ug##key.com/w77l35a9655
- sw###intin.com/09n71kly53
- cr###atsp.com/09n71kly53
- ni###hnih.com/8mxhuunwl1707l
- ug##key.com/8mxhuunwl1707l
- sw###intin.com/i7lwa5d6fc0k
- sw###intin.com/8mxhuunwl1707l
- cr###atsp.com/8mxhuunwl1707l
- br####sposter.com/8mxhuunwl1707l
- ni###hnih.com/w77l35a9655
- ug##key.com/63jdrxnyqas
- sw###intin.com/72teppk1xy75
- cr###atsp.com/72teppk1xy75
- cr###atsp.com/63jdrxnyqas
- br####sposter.com/63jdrxnyqas
- ni###hnih.com/63jdrxnyqas
- sw###intin.com/w77l35a9655
- cr###atsp.com/w77l35a9655
- br####sposter.com/w77l35a9655
- br####sposter.com/72teppk1xy75
- ni###hnih.com/72teppk1xy75
- ug##key.com/72teppk1xy75
- br####sposter.com/n3g14i359d0n570
- sw###intin.com/rf1y30s0842cg
- cr###atsp.com/rf1y30s0842cg
- br####sposter.com/rf1y30s0842cg
- br####sposter.com/2cyfhbz8e9yke
- ni###hnih.com/2cyfhbz8e9yke
- ug##key.com/2cyfhbz8e9yke
- cr###atsp.com/du9watda2db0
- br####sposter.com/du9watda2db0
- ni###hnih.com/du9watda2db0
- ni###hnih.com/rf1y30s0842cg
- ug##key.com/rf1y30s0842cg
- sw###intin.com/du9watda2db0
- cr###atsp.com/2cyfhbz8e9yke
- br####sposter.com/vib4b9g92ar9
- ni###hnih.com/vib4b9g92ar9
- ug##key.com/vib4b9g92ar9
- ug##key.com/htozs7qs0n5
- sw###intin.com/vib4b9g92ar9
- cr###atsp.com/vib4b9g92ar9
- ni###hnih.com/luqilto9ltsd
- ug##key.com/luqilto9ltsd
- sw###intin.com/2cyfhbz8e9yke
- sw###intin.com/luqilto9ltsd
- cr###atsp.com/luqilto9ltsd
- br####sposter.com/luqilto9ltsd
- ug##key.com/du9watda2db0
- cr###atsp.com/i96kan7sby
- br####sposter.com/i96kan7sby
- ni###hnih.com/i96kan7sby
- ni###hnih.com/i0fnbshuaxaitdx
- ug##key.com/i0fnbshuaxaitdx
- sw###intin.com/i96kan7sby
- br####sposter.com/izn7cn053j
- ni###hnih.com/izn7cn053j
- ug##key.com/izn7cn053j
- ug##key.com/i96kan7sby
- sw###intin.com/izn7cn053j
- cr###atsp.com/izn7cn053j
- br####sposter.com/i0fnbshuaxaitdx
- ni###hnih.com/at2jymcs670
- ug##key.com/at2jymcs670
- sw###intin.com/utaiw1imqr64
- sw###intin.com/at2jymcs670
- cr###atsp.com/at2jymcs670
- br####sposter.com/at2jymcs670
- ug##key.com/utaiw1imqr64
- sw###intin.com/i0fnbshuaxaitdx
- cr###atsp.com/i0fnbshuaxaitdx
- cr###atsp.com/utaiw1imqr64
- br####sposter.com/utaiw1imqr64
- ni###hnih.com/utaiw1imqr64
- ug##key.com/ljwu9j5h5rkqv7
- sw###intin.com/0sxycfgg3yl
- cr###atsp.com/0sxycfgg3yl
- cr###atsp.com/ljwu9j5h5rkqv7
- br####sposter.com/ljwu9j5h5rkqv7
- ni###hnih.com/ljwu9j5h5rkqv7
- sw###intin.com/a991a53jmv317
- cr###atsp.com/a991a53jmv317
- br####sposter.com/a991a53jmv317
- br####sposter.com/0sxycfgg3yl
- ni###hnih.com/0sxycfgg3yl
- ug##key.com/0sxycfgg3yl
- sw###intin.com/ljwu9j5h5rkqv7
- cr###atsp.com/gzy9br6f9h2
- br####sposter.com/gzy9br6f9h2
- ni###hnih.com/gzy9br6f9h2
- ni###hnih.com/n3g14i359d0n570
- ug##key.com/n3g14i359d0n570
- sw###intin.com/gzy9br6f9h2
- br####sposter.com/ndhfr5462jw
- ni###hnih.com/ndhfr5462jw
- ug##key.com/ndhfr5462jw
- ug##key.com/gzy9br6f9h2
- sw###intin.com/ndhfr5462jw
- cr###atsp.com/ndhfr5462jw
- ni###hnih.com/a991a53jmv317
- sw###intin.com/oxrcssstfye
- cr###atsp.com/oxrcssstfye
- br####sposter.com/oxrcssstfye
- br####sposter.com/5l0222cl59g9
- ni###hnih.com/5l0222cl59g9
- ug##key.com/5l0222cl59g9
- cr###atsp.com/htozs7qs0n5
- br####sposter.com/htozs7qs0n5
- ni###hnih.com/htozs7qs0n5
- ni###hnih.com/oxrcssstfye
- ug##key.com/oxrcssstfye
- sw###intin.com/htozs7qs0n5
- cr###atsp.com/5l0222cl59g9
- br####sposter.com/4n4463cb7j8
- ni###hnih.com/4n4463cb7j8
- ug##key.com/4n4463cb7j8
- ug##key.com/a991a53jmv317
- sw###intin.com/4n4463cb7j8
- cr###atsp.com/4n4463cb7j8
- ni###hnih.com/b7h72jrx01
- ug##key.com/b7h72jrx01
- sw###intin.com/5l0222cl59g9
- sw###intin.com/b7h72jrx01
- cr###atsp.com/b7h72jrx01
- br####sposter.com/b7h72jrx01
- br####sposter.com/cokxiwaq248ot
- ni###hnih.com/cokxiwaq248ot
- ug##key.com/cokxiwaq248ot
- ug##key.com/n52fdcnm3wuwv
- sw###intin.com/cokxiwaq248ot
- cr###atsp.com/cokxiwaq248ot
- ni###hnih.com/0e45d9vcz92m14
- ug##key.com/0e45d9vcz92m14
- sw###intin.com/3t49t58556h
- sw###intin.com/0e45d9vcz92m14
- cr###atsp.com/0e45d9vcz92m14
- br####sposter.com/0e45d9vcz92m14
- ni###hnih.com/n52fdcnm3wuwv
- ug##key.com/d07t27j3j7
- sw###intin.com/g167rbsftnhza
- cr###atsp.com/g167rbsftnhza
- cr###atsp.com/d07t27j3j7
- br####sposter.com/d07t27j3j7
- ni###hnih.com/d07t27j3j7
- sw###intin.com/n52fdcnm3wuwv
- cr###atsp.com/n52fdcnm3wuwv
- br####sposter.com/n52fdcnm3wuwv
- br####sposter.com/g167rbsftnhza
- ni###hnih.com/g167rbsftnhza
- ug##key.com/g167rbsftnhza
- cr###atsp.com/3t49t58556h
- ni###hnih.com/n2185s6c7ci0o
- ug##key.com/n2185s6c7ci0o
- sw###intin.com/aor51lhha8lud8z
- sw###intin.com/n2185s6c7ci0o
- cr###atsp.com/n2185s6c7ci0o
- br####sposter.com/n2185s6c7ci0o
- ug##key.com/aor51lhha8lud8z
- sw###intin.com/a1310q5pi618l
- cr###atsp.com/a1310q5pi618l
- cr###atsp.com/aor51lhha8lud8z
- br####sposter.com/aor51lhha8lud8z
- ni###hnih.com/aor51lhha8lud8z
- ug##key.com/gnv5b29zx9ug
- sw###intin.com/181812mg8o
- cr###atsp.com/181812mg8o
- br####sposter.com/181812mg8o
- br####sposter.com/3t49t58556h
- ni###hnih.com/3t49t58556h
- ug##key.com/3t49t58556h
- cr###atsp.com/gnv5b29zx9ug
- br####sposter.com/gnv5b29zx9ug
- ni###hnih.com/gnv5b29zx9ug
- ni###hnih.com/181812mg8o
- ug##key.com/181812mg8o
- sw###intin.com/gnv5b29zx9ug
- cr###atsp.com/m4791ltq3791z65
- br####sposter.com/m4791ltq3791z65
- ni###hnih.com/m4791ltq3791z65
- ni###hnih.com/yph4os0watmx
- ug##key.com/yph4os0watmx
- sw###intin.com/m4791ltq3791z65
- br####sposter.com/w0az901ij5px
- ni###hnih.com/w0az901ij5px
- ug##key.com/w0az901ij5px
- ug##key.com/m4791ltq3791z65
- sw###intin.com/w0az901ij5px
- cr###atsp.com/w0az901ij5px
- br####sposter.com/yph4os0watmx
- ni###hnih.com/ptbj2i4h48pyc5u
- ug##key.com/ptbj2i4h48pyc5u
- sw###intin.com/b4risl916f3td3d
- sw###intin.com/ptbj2i4h48pyc5u
- cr###atsp.com/ptbj2i4h48pyc5u
- br####sposter.com/ptbj2i4h48pyc5u
- ug##key.com/b4risl916f3td3d
- sw###intin.com/yph4os0watmx
- cr###atsp.com/yph4os0watmx
- cr###atsp.com/b4risl916f3td3d
- br####sposter.com/b4risl916f3td3d
- ni###hnih.com/b4risl916f3td3d
- sw###intin.com/hmpo7nfmqnibz
- br####sposter.com/dnjopep5eumuct
- ni###hnih.com/dnjopep5eumuct
- ug##key.com/dnjopep5eumuct
- ug##key.com/3vvb7ni1vtx
- sw###intin.com/dnjopep5eumuct
- cr###atsp.com/dnjopep5eumuct
- ni###hnih.com/a2l6uqqfk3nz
- ug##key.com/a2l6uqqfk3nz
- sw###intin.com/d07t27j3j7
- sw###intin.com/a2l6uqqfk3nz
- cr###atsp.com/a2l6uqqfk3nz
- br####sposter.com/a2l6uqqfk3nz
- ni###hnih.com/3vvb7ni1vtx
- ug##key.com/hmpo7nfmqnibz
- sw###intin.com/7n0qaxgezde5
- cr###atsp.com/7n0qaxgezde5
- cr###atsp.com/hmpo7nfmqnibz
- br####sposter.com/hmpo7nfmqnibz
- ni###hnih.com/hmpo7nfmqnibz
- sw###intin.com/3vvb7ni1vtx
- cr###atsp.com/3vvb7ni1vtx
- br####sposter.com/3vvb7ni1vtx
- br####sposter.com/7n0qaxgezde5
- ni###hnih.com/7n0qaxgezde5
- ug##key.com/7n0qaxgezde5
- br####sposter.com/a1310q5pi618l
- sw###intin.com/ohn4xp4c8ajslp
- cr###atsp.com/ohn4xp4c8ajslp
- br####sposter.com/ohn4xp4c8ajslp
- br####sposter.com/uasqegqizh5jh
- ni###hnih.com/uasqegqizh5jh
- ug##key.com/uasqegqizh5jh
- cr###atsp.com/odhxmpuq1c25xtk
- br####sposter.com/odhxmpuq1c25xtk
- ni###hnih.com/odhxmpuq1c25xtk
- ni###hnih.com/ohn4xp4c8ajslp
- ug##key.com/ohn4xp4c8ajslp
- sw###intin.com/odhxmpuq1c25xtk
- cr###atsp.com/uasqegqizh5jh
- br####sposter.com/qelmyf03arrnaf
- ni###hnih.com/qelmyf03arrnaf
- ug##key.com/qelmyf03arrnaf
- ug##key.com/fdjc79j6em4jyb2
- sw###intin.com/qelmyf03arrnaf
- cr###atsp.com/qelmyf03arrnaf
- ni###hnih.com/m3frbd03wd
- ug##key.com/m3frbd03wd
- sw###intin.com/uasqegqizh5jh
- sw###intin.com/m3frbd03wd
- cr###atsp.com/m3frbd03wd
- br####sposter.com/m3frbd03wd
- ug##key.com/odhxmpuq1c25xtk
- cr###atsp.com/al40m9zc16
- br####sposter.com/al40m9zc16
- ni###hnih.com/al40m9zc16
- ni###hnih.com/ppurt1ro7p
- ug##key.com/ppurt1ro7p
- sw###intin.com/al40m9zc16
- br####sposter.com/xkzzivhvfsnw
- ni###hnih.com/xkzzivhvfsnw
- ug##key.com/xkzzivhvfsnw
- ug##key.com/al40m9zc16
- sw###intin.com/xkzzivhvfsnw
- cr###atsp.com/xkzzivhvfsnw
- br####sposter.com/ppurt1ro7p
- ni###hnih.com/3d6ist298haft6
- ug##key.com/3d6ist298haft6
- sw###intin.com/vrjyk6ywwmpjf
- sw###intin.com/3d6ist298haft6
- cr###atsp.com/3d6ist298haft6
- br####sposter.com/3d6ist298haft6
- ug##key.com/vrjyk6ywwmpjf
- sw###intin.com/ppurt1ro7p
- cr###atsp.com/ppurt1ro7p
- cr###atsp.com/vrjyk6ywwmpjf
- br####sposter.com/vrjyk6ywwmpjf
- ni###hnih.com/vrjyk6ywwmpjf
- ug##key.com/mwuffi40sw739h
- sw###intin.com/7ku83ny0r43xk
- cr###atsp.com/7ku83ny0r43xk
- cr###atsp.com/mwuffi40sw739h
- br####sposter.com/mwuffi40sw739h
- ni###hnih.com/mwuffi40sw739h
- sw###intin.com/l7rd5rt0wufi5
- cr###atsp.com/l7rd5rt0wufi5
- br####sposter.com/l7rd5rt0wufi5
- br####sposter.com/7ku83ny0r43xk
- ni###hnih.com/7ku83ny0r43xk
- ug##key.com/7ku83ny0r43xk
- sw###intin.com/mwuffi40sw739h
- cr###atsp.com/59lid443o6
- br####sposter.com/59lid443o6
- ni###hnih.com/59lid443o6
- ni###hnih.com/a1310q5pi618l
- ug##key.com/a1310q5pi618l
- sw###intin.com/59lid443o6
- br####sposter.com/u5sedhadfrkirjk
- ni###hnih.com/u5sedhadfrkirjk
- ug##key.com/u5sedhadfrkirjk
- ug##key.com/59lid443o6
- sw###intin.com/u5sedhadfrkirjk
- cr###atsp.com/u5sedhadfrkirjk
- ni###hnih.com/l7rd5rt0wufi5
- sw###intin.com/56a459o8u0m24bz
- cr###atsp.com/56a459o8u0m24bz
- br####sposter.com/56a459o8u0m24bz
- br####sposter.com/i88ex791j7
- ni###hnih.com/i88ex791j7
- ug##key.com/i88ex791j7
- cr###atsp.com/fdjc79j6em4jyb2
- br####sposter.com/fdjc79j6em4jyb2
- ni###hnih.com/fdjc79j6em4jyb2
- ni###hnih.com/56a459o8u0m24bz
- ug##key.com/56a459o8u0m24bz
- sw###intin.com/fdjc79j6em4jyb2
- cr###atsp.com/i88ex791j7
- br####sposter.com/zs23wrjcpl
- ni###hnih.com/zs23wrjcpl
- ug##key.com/zs23wrjcpl
- ug##key.com/l7rd5rt0wufi5
- sw###intin.com/zs23wrjcpl
- cr###atsp.com/zs23wrjcpl
- ni###hnih.com/o5ehkbkwzvcr
- ug##key.com/o5ehkbkwzvcr
- sw###intin.com/i88ex791j7
- sw###intin.com/o5ehkbkwzvcr
- cr###atsp.com/o5ehkbkwzvcr
- br####sposter.com/o5ehkbkwzvcr
UDP:
- DNS ASK ni###hnih.com
- DNS ASK ug##key.com
- DNS ASK br####sposter.com
- DNS ASK sw###intin.com
- DNS ASK cr###atsp.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
