Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '62a62bd' = '%APPDATA%\Roaming\62a62bd.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] '*2a62bd' = '%APPDATA%\Roaming\62a62bd.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '62a62b' = 'C:\62a62bd\62a62bd.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] '*2a62b' = 'C:\62a62bd\62a62bd.exe'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
Executes the following:
- '<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\svchost.exe' -k swprv
- '<SYSTEM32>\bcdedit.exe' /set {default} recoveryenabled No
- '%WINDIR%\explorer.exe'
- '<SYSTEM32>\svchost.exe' netsvcs
- '<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
- %WINDIR%\explorer.exe
Modifies file system :
Creates the following files:
- %APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\62a62bd.exe
- %APPDATA%\Roaming\62a62bd.exe
- C:\62a62bd\62a62bd.exe
Network activity:
Connects to:
- 'ni###hnih.com':80
- 'ug##key.com':80
- 'br####sposter.com':80
- 'sw###intin.com':80
- 'cr###atsp.com':80
TCP:
HTTP POST requests:
- sw###intin.com/ixqtcafjcjm2hc
- cr###atsp.com/ixqtcafjcjm2hc
- br####sposter.com/ixqtcafjcjm2hc
- br####sposter.com/82iacw07ecl
- ni###hnih.com/82iacw07ecl
- ug##key.com/82iacw07ecl
- cr###atsp.com/rd163szxea6yz5z
- br####sposter.com/rd163szxea6yz5z
- ni###hnih.com/rd163szxea6yz5z
- ni###hnih.com/ixqtcafjcjm2hc
- ug##key.com/ixqtcafjcjm2hc
- sw###intin.com/rd163szxea6yz5z
- cr###atsp.com/82iacw07ecl
- br####sposter.com/vo9rhsr3dd
- ni###hnih.com/vo9rhsr3dd
- ug##key.com/vo9rhsr3dd
- ug##key.com/nymmfj1gbjwx
- sw###intin.com/vo9rhsr3dd
- cr###atsp.com/vo9rhsr3dd
- ni###hnih.com/029563es2vx6c3
- ug##key.com/029563es2vx6c3
- sw###intin.com/82iacw07ecl
- sw###intin.com/029563es2vx6c3
- cr###atsp.com/029563es2vx6c3
- br####sposter.com/029563es2vx6c3
- ug##key.com/rd163szxea6yz5z
- cr###atsp.com/49ls3z47l48320
- br####sposter.com/49ls3z47l48320
- ni###hnih.com/49ls3z47l48320
- ni###hnih.com/12tdn1zhqry
- ug##key.com/12tdn1zhqry
- sw###intin.com/49ls3z47l48320
- br####sposter.com/qggwnan8u1
- ni###hnih.com/qggwnan8u1
- ug##key.com/qggwnan8u1
- ug##key.com/49ls3z47l48320
- sw###intin.com/qggwnan8u1
- cr###atsp.com/qggwnan8u1
- br####sposter.com/12tdn1zhqry
- ni###hnih.com/6lzw5xu27rlz
- ug##key.com/6lzw5xu27rlz
- sw###intin.com/lkcb4y5hmc
- sw###intin.com/6lzw5xu27rlz
- cr###atsp.com/6lzw5xu27rlz
- br####sposter.com/6lzw5xu27rlz
- ug##key.com/lkcb4y5hmc
- sw###intin.com/12tdn1zhqry
- cr###atsp.com/12tdn1zhqry
- cr###atsp.com/lkcb4y5hmc
- br####sposter.com/lkcb4y5hmc
- ni###hnih.com/lkcb4y5hmc
- ni###hnih.com/nymmfj1gbjwx
- ni###hnih.com/3c8nl1094e
- ug##key.com/3c8nl1094e
- sw###intin.com/76jy2778ixw
- sw###intin.com/3c8nl1094e
- cr###atsp.com/3c8nl1094e
- br####sposter.com/3c8nl1094e
- ug##key.com/76jy2778ixw
- sw###intin.com/gq4b1xoqjv3e
- cr###atsp.com/gq4b1xoqjv3e
- cr###atsp.com/76jy2778ixw
- br####sposter.com/76jy2778ixw
- ni###hnih.com/76jy2778ixw
- ug##key.com/co8wm4l05nc
- sw###intin.com/v5qxerzrnbkw0x
- cr###atsp.com/v5qxerzrnbkw0x
- br####sposter.com/v5qxerzrnbkw0x
- br####sposter.com/v8nkiwjtpwlwdp
- ni###hnih.com/v8nkiwjtpwlwdp
- ug##key.com/v8nkiwjtpwlwdp
- cr###atsp.com/co8wm4l05nc
- br####sposter.com/co8wm4l05nc
- ni###hnih.com/co8wm4l05nc
- ni###hnih.com/v5qxerzrnbkw0x
- ug##key.com/v5qxerzrnbkw0x
- sw###intin.com/co8wm4l05nc
- br####sposter.com/gq4b1xoqjv3e
- ug##key.com/vfk2u0q6a4
- sw###intin.com/6j618kdur2l
- cr###atsp.com/6j618kdur2l
- cr###atsp.com/vfk2u0q6a4
- br####sposter.com/vfk2u0q6a4
- ni###hnih.com/vfk2u0q6a4
- sw###intin.com/nymmfj1gbjwx
- cr###atsp.com/nymmfj1gbjwx
- br####sposter.com/nymmfj1gbjwx
- br####sposter.com/6j618kdur2l
- ni###hnih.com/6j618kdur2l
- ug##key.com/6j618kdur2l
- sw###intin.com/vfk2u0q6a4
- cr###atsp.com/o82adcsk484
- br####sposter.com/o82adcsk484
- ni###hnih.com/o82adcsk484
- ni###hnih.com/gq4b1xoqjv3e
- ug##key.com/gq4b1xoqjv3e
- sw###intin.com/o82adcsk484
- br####sposter.com/cm5tms8937
- ni###hnih.com/cm5tms8937
- ug##key.com/cm5tms8937
- ug##key.com/o82adcsk484
- sw###intin.com/cm5tms8937
- cr###atsp.com/cm5tms8937
- sw###intin.com/ivb4fi184la042
- ug##key.com/potyzquem7k9d
- sw###intin.com/8ifkrxn156pg54o
- cr###atsp.com/8ifkrxn156pg54o
- cr###atsp.com/potyzquem7k9d
- br####sposter.com/potyzquem7k9d
- ni###hnih.com/potyzquem7k9d
- sw###intin.com/upf7weuasp361j1
- cr###atsp.com/upf7weuasp361j1
- br####sposter.com/upf7weuasp361j1
- br####sposter.com/8ifkrxn156pg54o
- ni###hnih.com/8ifkrxn156pg54o
- ug##key.com/8ifkrxn156pg54o
- sw###intin.com/potyzquem7k9d
- cr###atsp.com/pque9r5vcmnh6
- br####sposter.com/pque9r5vcmnh6
- ni###hnih.com/pque9r5vcmnh6
- ni###hnih.com/7dyqksvzmm3ivg7
- ug##key.com/7dyqksvzmm3ivg7
- sw###intin.com/pque9r5vcmnh6
- br####sposter.com/2am44796qmq0h09
- ni###hnih.com/2am44796qmq0h09
- ug##key.com/2am44796qmq0h09
- ug##key.com/pque9r5vcmnh6
- sw###intin.com/2am44796qmq0h09
- cr###atsp.com/2am44796qmq0h09
- ni###hnih.com/upf7weuasp361j1
- sw###intin.com/19s4z6zd15527
- cr###atsp.com/19s4z6zd15527
- br####sposter.com/19s4z6zd15527
- br####sposter.com/q9i3ra8v4cxjj
- ni###hnih.com/q9i3ra8v4cxjj
- ug##key.com/q9i3ra8v4cxjj
- cr###atsp.com/faem1ja6l9d2w4c
- br####sposter.com/faem1ja6l9d2w4c
- ni###hnih.com/faem1ja6l9d2w4c
- ni###hnih.com/19s4z6zd15527
- ug##key.com/19s4z6zd15527
- sw###intin.com/faem1ja6l9d2w4c
- cr###atsp.com/q9i3ra8v4cxjj
- br####sposter.com/rp90g2f4z79pg7
- ni###hnih.com/rp90g2f4z79pg7
- ug##key.com/rp90g2f4z79pg7
- ug##key.com/upf7weuasp361j1
- sw###intin.com/rp90g2f4z79pg7
- cr###atsp.com/rp90g2f4z79pg7
- ni###hnih.com/8er1h0xd89cu7v
- ug##key.com/8er1h0xd89cu7v
- sw###intin.com/q9i3ra8v4cxjj
- sw###intin.com/8er1h0xd89cu7v
- cr###atsp.com/8er1h0xd89cu7v
- br####sposter.com/8er1h0xd89cu7v
- br####sposter.com/7dyqksvzmm3ivg7
- br####sposter.com/1qb931vqcd
- ni###hnih.com/1qb931vqcd
- ug##key.com/1qb931vqcd
- ug##key.com/rwh1segjgm
- sw###intin.com/1qb931vqcd
- cr###atsp.com/1qb931vqcd
- ni###hnih.com/che3ipxpkvtze
- ug##key.com/che3ipxpkvtze
- sw###intin.com/5tc1xx21pel8nw9
- sw###intin.com/che3ipxpkvtze
- cr###atsp.com/che3ipxpkvtze
- br####sposter.com/che3ipxpkvtze
- ni###hnih.com/rwh1segjgm
- ug##key.com/ivb4fi184la042
- sw###intin.com/8o4j2gf8bz05
- cr###atsp.com/8o4j2gf8bz05
- cr###atsp.com/ivb4fi184la042
- br####sposter.com/ivb4fi184la042
- ni###hnih.com/ivb4fi184la042
- sw###intin.com/rwh1segjgm
- cr###atsp.com/rwh1segjgm
- br####sposter.com/rwh1segjgm
- br####sposter.com/8o4j2gf8bz05
- ni###hnih.com/8o4j2gf8bz05
- ug##key.com/8o4j2gf8bz05
- cr###atsp.com/5tc1xx21pel8nw9
- ni###hnih.com/zkmglrfdzhk26t1
- ug##key.com/zkmglrfdzhk26t1
- sw###intin.com/4al6bv8o0av
- sw###intin.com/zkmglrfdzhk26t1
- cr###atsp.com/zkmglrfdzhk26t1
- br####sposter.com/zkmglrfdzhk26t1
- ug##key.com/4al6bv8o0av
- sw###intin.com/7dyqksvzmm3ivg7
- cr###atsp.com/7dyqksvzmm3ivg7
- cr###atsp.com/4al6bv8o0av
- br####sposter.com/4al6bv8o0av
- ni###hnih.com/4al6bv8o0av
- ug##key.com/w5s35qzh63jqja
- sw###intin.com/dbsbkbh17u
- cr###atsp.com/dbsbkbh17u
- br####sposter.com/dbsbkbh17u
- br####sposter.com/5tc1xx21pel8nw9
- ni###hnih.com/5tc1xx21pel8nw9
- ug##key.com/5tc1xx21pel8nw9
- cr###atsp.com/w5s35qzh63jqja
- br####sposter.com/w5s35qzh63jqja
- ni###hnih.com/w5s35qzh63jqja
- ni###hnih.com/dbsbkbh17u
- ug##key.com/dbsbkbh17u
- sw###intin.com/w5s35qzh63jqja
- ni###hnih.com/kjdivzdk1qp4
- ug##key.com/kjdivzdk1qp4
- sw###intin.com/urzxz0qun9
- sw###intin.com/kjdivzdk1qp4
- cr###atsp.com/kjdivzdk1qp4
- br####sposter.com/kjdivzdk1qp4
- ug##key.com/urzxz0qun9
- sw###intin.com/ekccq1b4ycxx1v
- cr###atsp.com/ekccq1b4ycxx1v
- cr###atsp.com/urzxz0qun9
- br####sposter.com/urzxz0qun9
- ni###hnih.com/urzxz0qun9
- ug##key.com/s2ulb5mvazz6kyw
- sw###intin.com/vokiusuwll6
- cr###atsp.com/vokiusuwll6
- br####sposter.com/vokiusuwll6
- br####sposter.com/o2w995dvbp
- ni###hnih.com/o2w995dvbp
- ug##key.com/o2w995dvbp
- cr###atsp.com/s2ulb5mvazz6kyw
- br####sposter.com/s2ulb5mvazz6kyw
- ni###hnih.com/s2ulb5mvazz6kyw
- ni###hnih.com/vokiusuwll6
- ug##key.com/vokiusuwll6
- sw###intin.com/s2ulb5mvazz6kyw
- br####sposter.com/ekccq1b4ycxx1v
- ug##key.com/1lmcc14yfyjk8
- sw###intin.com/qsakzyzwu9
- cr###atsp.com/qsakzyzwu9
- cr###atsp.com/1lmcc14yfyjk8
- br####sposter.com/1lmcc14yfyjk8
- ni###hnih.com/1lmcc14yfyjk8
- sw###intin.com/qwy37ard9dsfx
- cr###atsp.com/qwy37ard9dsfx
- br####sposter.com/qwy37ard9dsfx
- br####sposter.com/qsakzyzwu9
- ni###hnih.com/qsakzyzwu9
- ug##key.com/qsakzyzwu9
- sw###intin.com/1lmcc14yfyjk8
- cr###atsp.com/gzoi7dclavcjv
- br####sposter.com/gzoi7dclavcjv
- ni###hnih.com/gzoi7dclavcjv
- ni###hnih.com/ekccq1b4ycxx1v
- ug##key.com/ekccq1b4ycxx1v
- sw###intin.com/gzoi7dclavcjv
- br####sposter.com/j921j46cbi
- ni###hnih.com/j921j46cbi
- ug##key.com/j921j46cbi
- ug##key.com/gzoi7dclavcjv
- sw###intin.com/j921j46cbi
- cr###atsp.com/j921j46cbi
- cr###atsp.com/o2w995dvbp
- cr###atsp.com/w835zqiehibes5
- br####sposter.com/w835zqiehibes5
- ni###hnih.com/w835zqiehibes5
- ni###hnih.com/t7isbzqlzq
- ug##key.com/t7isbzqlzq
- sw###intin.com/w835zqiehibes5
- br####sposter.com/r25jl7us7zdrc8
- ni###hnih.com/r25jl7us7zdrc8
- ug##key.com/r25jl7us7zdrc8
- ug##key.com/w835zqiehibes5
- sw###intin.com/r25jl7us7zdrc8
- cr###atsp.com/r25jl7us7zdrc8
- br####sposter.com/t7isbzqlzq
- ni###hnih.com/r5vgtywwvsbib
- ug##key.com/r5vgtywwvsbib
- sw###intin.com/g5jdyih0gr
- sw###intin.com/r5vgtywwvsbib
- cr###atsp.com/r5vgtywwvsbib
- br####sposter.com/r5vgtywwvsbib
- ug##key.com/g5jdyih0gr
- sw###intin.com/t7isbzqlzq
- cr###atsp.com/t7isbzqlzq
- cr###atsp.com/g5jdyih0gr
- br####sposter.com/g5jdyih0gr
- ni###hnih.com/g5jdyih0gr
- sw###intin.com/sowyrzaom6m
- br####sposter.com/zkwt4dtjc5cd5
- ni###hnih.com/zkwt4dtjc5cd5
- ug##key.com/zkwt4dtjc5cd5
- ug##key.com/4rosf700z70xe
- sw###intin.com/zkwt4dtjc5cd5
- cr###atsp.com/zkwt4dtjc5cd5
- ni###hnih.com/cujzwvohqq7if
- ug##key.com/cujzwvohqq7if
- sw###intin.com/o2w995dvbp
- sw###intin.com/cujzwvohqq7if
- cr###atsp.com/cujzwvohqq7if
- br####sposter.com/cujzwvohqq7if
- ni###hnih.com/4rosf700z70xe
- ug##key.com/sowyrzaom6m
- sw###intin.com/88qn84zhhvxok4d
- cr###atsp.com/88qn84zhhvxok4d
- cr###atsp.com/sowyrzaom6m
- br####sposter.com/sowyrzaom6m
- ni###hnih.com/sowyrzaom6m
- sw###intin.com/4rosf700z70xe
- cr###atsp.com/4rosf700z70xe
- br####sposter.com/4rosf700z70xe
- br####sposter.com/88qn84zhhvxok4d
- ni###hnih.com/88qn84zhhvxok4d
- ug##key.com/88qn84zhhvxok4d
- ni###hnih.com/qwy37ard9dsfx
- br####sposter.com/7fmu0g622595
- ni###hnih.com/7fmu0g622595
- ug##key.com/7fmu0g622595
- ug##key.com/vijbwehaj102e9
- sw###intin.com/7fmu0g622595
- cr###atsp.com/7fmu0g622595
- ni###hnih.com/n1zh0tvv524
- ug##key.com/n1zh0tvv524
- sw###intin.com/czb8y62918u7x
- sw###intin.com/n1zh0tvv524
- cr###atsp.com/n1zh0tvv524
- br####sposter.com/n1zh0tvv524
- ni###hnih.com/vijbwehaj102e9
- ug##key.com/lsmiep51sxlv9
- sw###intin.com/wo5895kfuiy
- cr###atsp.com/wo5895kfuiy
- cr###atsp.com/lsmiep51sxlv9
- br####sposter.com/lsmiep51sxlv9
- ni###hnih.com/lsmiep51sxlv9
- sw###intin.com/vijbwehaj102e9
- cr###atsp.com/vijbwehaj102e9
- br####sposter.com/vijbwehaj102e9
- br####sposter.com/wo5895kfuiy
- ni###hnih.com/wo5895kfuiy
- ug##key.com/wo5895kfuiy
- cr###atsp.com/czb8y62918u7x
- ni###hnih.com/r6k6ye4qv6cp
- ug##key.com/r6k6ye4qv6cp
- sw###intin.com/jlct6r5ox91m4
- sw###intin.com/r6k6ye4qv6cp
- cr###atsp.com/r6k6ye4qv6cp
- br####sposter.com/r6k6ye4qv6cp
- ug##key.com/jlct6r5ox91m4
- sw###intin.com/v8nkiwjtpwlwdp
- cr###atsp.com/v8nkiwjtpwlwdp
- cr###atsp.com/jlct6r5ox91m4
- br####sposter.com/jlct6r5ox91m4
- ni###hnih.com/jlct6r5ox91m4
- ug##key.com/0bylce3197z
- sw###intin.com/ksuefz8whzxrpdr
- cr###atsp.com/ksuefz8whzxrpdr
- br####sposter.com/ksuefz8whzxrpdr
- br####sposter.com/czb8y62918u7x
- ni###hnih.com/czb8y62918u7x
- ug##key.com/czb8y62918u7x
- cr###atsp.com/0bylce3197z
- br####sposter.com/0bylce3197z
- ni###hnih.com/0bylce3197z
- ni###hnih.com/ksuefz8whzxrpdr
- ug##key.com/ksuefz8whzxrpdr
- sw###intin.com/0bylce3197z
- sw###intin.com/lsmiep51sxlv9
- sw###intin.com/ei8g6zmrg1k
- cr###atsp.com/ei8g6zmrg1k
- br####sposter.com/ei8g6zmrg1k
- br####sposter.com/f9dvpthuuswcec
- ni###hnih.com/f9dvpthuuswcec
- ug##key.com/f9dvpthuuswcec
- cr###atsp.com/ztqovtgxmhvw
- br####sposter.com/ztqovtgxmhvw
- ni###hnih.com/ztqovtgxmhvw
- ni###hnih.com/ei8g6zmrg1k
- ug##key.com/ei8g6zmrg1k
- sw###intin.com/ztqovtgxmhvw
- cr###atsp.com/f9dvpthuuswcec
- br####sposter.com/xhup2kxg0k6
- ni###hnih.com/xhup2kxg0k6
- ug##key.com/xhup2kxg0k6
- ug##key.com/qwy37ard9dsfx
- sw###intin.com/xhup2kxg0k6
- cr###atsp.com/xhup2kxg0k6
- ni###hnih.com/8y4q49pz7z88g9w
- ug##key.com/8y4q49pz7z88g9w
- sw###intin.com/f9dvpthuuswcec
- sw###intin.com/8y4q49pz7z88g9w
- cr###atsp.com/8y4q49pz7z88g9w
- br####sposter.com/8y4q49pz7z88g9w
- ug##key.com/ztqovtgxmhvw
- cr###atsp.com/x934zhozg7e1lz
- br####sposter.com/x934zhozg7e1lz
- ni###hnih.com/x934zhozg7e1lz
- ni###hnih.com/drtgzmyza6
- ug##key.com/drtgzmyza6
- sw###intin.com/x934zhozg7e1lz
- br####sposter.com/p37ld9i4hiqe584
- ni###hnih.com/p37ld9i4hiqe584
- ug##key.com/p37ld9i4hiqe584
- ug##key.com/x934zhozg7e1lz
- sw###intin.com/p37ld9i4hiqe584
- cr###atsp.com/p37ld9i4hiqe584
- br####sposter.com/drtgzmyza6
- ni###hnih.com/b03rm6d6q0t
- ug##key.com/b03rm6d6q0t
- sw###intin.com/vb604bp90zyfam
- sw###intin.com/b03rm6d6q0t
- cr###atsp.com/b03rm6d6q0t
- br####sposter.com/b03rm6d6q0t
- ug##key.com/vb604bp90zyfam
- sw###intin.com/drtgzmyza6
- cr###atsp.com/drtgzmyza6
- cr###atsp.com/vb604bp90zyfam
- br####sposter.com/vb604bp90zyfam
- ni###hnih.com/vb604bp90zyfam
UDP:
- DNS ASK ni###hnih.com
- DNS ASK ug##key.com
- DNS ASK br####sposter.com
- DNS ASK sw###intin.com
- DNS ASK cr###atsp.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
