Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '11f86284' = '%LOCALAPPDATA%\Alpha\dllhost.exe'
Modifies file system
Creates the following files
- %LOCALAPPDATA%\alpha\dllhost.exe
- %LOCALAPPDATA%\alpha\zdllhost.exe
- %LOCALAPPDATA%\alpha\log.dat
- %LOCALAPPDATA%\alpha\udb\a7\74.dat
- %LOCALAPPDATA%\alpha\udb\6f\96.dat
- %LOCALAPPDATA%\alpha\obj\6f966c1a.dat
- %LOCALAPPDATA%\alpha\udb\55\36.dat
- %LOCALAPPDATA%\alpha\udb\50\66.dat
- %LOCALAPPDATA%\alpha\udb\84\57.dat
Network activity
Connects to
- 'th###ewnews.net':80
- 'lm#####ltingservices.ca':80
- 'lm#####ltingservices.ca':443
- 'google.com':443
- 'bing.com':443
- 'pa####astgov.com':80
- 'pa####astgov.com':443
- 'we######tgaragedoors.com.au':80
- 'we######tgaragedoors.com.au':443
- 'th####rodgarage.com':80
- 'th####rodgarage.com':443
- 'sm######rsandgates.com.au':80
- 'sm######rsandgates.com.au':443
- 'pi#######luxurygarage.com.au':80
- 'pi#######luxurygarage.com.au':443
TCP
HTTP GET requests
- http://www.pa####astgov.com/xmlrpc.php
- http://www.we######tgaragedoors.com.au/wp-login.php
- http://www.we######tgaragedoors.com.au/?au######
- http://www.we######tgaragedoors.com.au/author/adminas/
- http://th####rodgarage.com/xmlrpc.php
- http://sm######rsandgates.com.au/xmlrpc.php
- http://pi#######luxurygarage.com.au/xmlrpc.php
HTTP POST requests
- http://th###ewnews.net/wp-content/plugins/WPSecurity/load.php
- http://www.lm#####ltingservices.ca/wp-content/plugins/WPSecurity/load.php
- http://www.we######tgaragedoors.com.au/xmlrpc.php
Other
- 'lm#####ltingservices.ca':443
- 'google.com':443
- 'bing.com':443
- 'pa####astgov.com':443
- 'we######tgaragedoors.com.au':443
- 'th####rodgarage.com':443
- 'sm######rsandgates.com.au':443
- 'pi#######luxurygarage.com.au':443
UDP
- DNS ASK th###ewnews.net
- DNS ASK na####otelthai.com
- DNS ASK lm#####ltingservices.ca
- DNS ASK av######ertymalaysia.com
- DNS ASK google.com
- DNS ASK bing.com
- DNS ASK pa####astgov.com
- DNS ASK we######tgaragedoors.com.au
- DNS ASK th####rodgarage.com
- DNS ASK sm######rsandgates.com.au
- DNS ASK pi#######luxurygarage.com.au
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\alpha\dllhost.exe'
- '%LOCALAPPDATA%\alpha\zdllhost.exe' --c
- '%LOCALAPPDATA%\alpha\zdllhost.exe' --cs
- '%LOCALAPPDATA%\alpha\zdllhost.exe' --w
- '%LOCALAPPDATA%\alpha\zdllhost.exe' --p
- '%LOCALAPPDATA%\alpha\zdllhost.exe' --b
- '%WINDIR%\syswow64\cmd.exe' /c type "<Full path to file>" > "%LOCALAPPDATA%\Alpha\dllhost.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c type "<Full path to file>" > "%LOCALAPPDATA%\Alpha\zdllhost.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c pushd %LOCALAPPDATA%\Alpha & start dllhost.exe & popd' (with hidden window)
- '%LOCALAPPDATA%\alpha\zdllhost.exe' --c' (with hidden window)
- '%LOCALAPPDATA%\alpha\zdllhost.exe' --cs' (with hidden window)
- '%LOCALAPPDATA%\alpha\zdllhost.exe' --w' (with hidden window)
- '%LOCALAPPDATA%\alpha\zdllhost.exe' --p' (with hidden window)
- '%LOCALAPPDATA%\alpha\zdllhost.exe' --b' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c type "<Full path to file>" > "%LOCALAPPDATA%\Alpha\dllhost.exe"
- '%WINDIR%\syswow64\cmd.exe' /c type "<Full path to file>" > "%LOCALAPPDATA%\Alpha\zdllhost.exe"
- '%WINDIR%\syswow64\cmd.exe' /c pushd %LOCALAPPDATA%\Alpha & start dllhost.exe & popd
