Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'WigWaggM' = '%APPDATA%\SaHaks.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '%APPDATA%\SaHaks.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WigWaggM' = '%APPDATA%\SaHaks.exe'
Creates the following files on removable media:
- <Drive name for removable media>:\noname.lnk
Malicious functions:
Creates and executes the following:
- %APPDATA%\SaHaks.exe
Executes the following:
- %WINDIR%\explorer.exe
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
- %WINDIR%\Explorer.EXE
Terminates or attempts to terminate
the following user processes:
- AVP.EXE
Hides the following processes:
- <Full path to virus>
- %APPDATA%\SaHaks.exe
Modifies file system :
Creates the following files:
- %TEMP%\windump.exe
- %APPDATA%\imm.dll
- %APPDATA%\SaHaks.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\imm.dll
- %APPDATA%\SaHaks.exe
Network activity:
Connects to:
- '11#.#8.211.233':4444
- '25#.#04.232.204':4444
- '17#.#9.51.131':4444
- '27.##3.213.32':4444
- '24#.#1.195.134':4444
- '17#.#61.83.251':4444
- '10#.#28.193.249':4444
- '51.##.89.251':4444
- '21#.#97.86.51':4444
- '41.##4.68.153':4444
- '93.##.103.35':4444
- '87.##.56.123':4444
- '21.##0.167.121':4444
- '84.##1.34.227':4444
- '22#.#09.96.128':4444
- '22#.#08.104.178':4444
- '97.##4.10.40':4444
- '31.##1.120.37':4444
- '26.##7.76.244':4444
- '83.##4.22.246':4444
- '21#.#6.30.41':4444
- '22#.#58.230.101':4444
- '58.##1.212.76':4444
- '15.##.120.254':4444
- '19#.#46.195.54':4444
- '15#.#12.49.156':4444
- '3.###.88.172':4444
- '<Private IP address>':445
- '<Private IP address>':80
- 'ba####.kazeu.net':23232
- '12#.#18.67.73':4444
- '10#.#3.213.208':4444
- '5.##.45.139':4444
- '21#.#85.27.114':4444
- '14#.#40.101.41':4444
- '62.##1.176.96':4444
- '18#.#74.119.194':4444
- 'ga#####g.lowerland.org':23232
- '44.##.102.210':4444
- '11#.#46.247.213':4444
- '<Private IP address>':139
- '17#.#3.136.215':4444
UDP:
- DNS ASK ga#####g.lowerland.org
- DNS ASK ba####.kazeu.net
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
