Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [\REGISTRY\USER\S-1-5-21-1238866942-1249195528-555854008-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'EdgeUpdater' = '<Full path to file>'
Modifies file system
Creates the following files
- D:\windows\system32\config\software.log1
- D:\windows\system32\config\system
- D:\windows\system32\config\system.log1
- D:\windows\system32\winevt\logs\system.evtx
- D:\windows\system32\winevt\logs\security.evtx
- D:\users\user\appdata\local\temp\taracba.tmp
- D:\users\user\appdata\local\temp\cabacb9.tmp
- D:\users\user\appdata\local\temp\tarabed.tmp
- D:\users\user\appdata\local\temp\cababec.tmp
- D:\users\user\appdata\local\temp\tarabac.tmp
- D:\users\user\appdata\local\temp\cababab.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\94308059b57b3142e455b38a6eb92015
- D:\users\user\appdata\local\temp\taraa34.tmp
- D:\users\user\appdata\local\temp\cabaa33.tmp
- D:\system volume information\syscache.hve
- D:\system volume information\syscache.hve.log1
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat.log1
- D:\users\user\ntuser.dat
- D:\users\user\ntuser.dat.log1
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive1.dat
- D:\windows\system32\config\software
- D:\windows\system32\winevt\logs\microsoft-windows-networkprofile%4operational.evtx
- D:\windows\system32\winevt\logs\application.evtx
Deletes the following files
- D:\users\user\appdata\local\temp\cabaa33.tmp
- D:\users\user\appdata\local\temp\taraa34.tmp
- D:\users\user\appdata\local\temp\cababab.tmp
- D:\users\user\appdata\local\temp\tarabac.tmp
- D:\users\user\appdata\local\temp\cababec.tmp
- D:\users\user\appdata\local\temp\tarabed.tmp
- D:\users\user\appdata\local\temp\cabacb9.tmp
- D:\users\user\appdata\local\temp\taracba.tmp
Network activity
Connects to
- 'ms#####.#ion.feralhosting.com':80
- 'ms#####.#allas.feralhosting.com':80
- '18#.#5.48.68':80
- '18#.#5.48.68':443
- 'pa###bin.com':80
- 'pa###bin.com':443
TCP
HTTP GET requests
- http://ms#####.#ion.feralhosting.com/3753f9ba56bb6017239d22387fc53035
- http://ms#####.#ion.feralhosting.com/4a8774400e6d2e209109d021a74e2d3c
- http://ms#####.#allas.feralhosting.com/034220e27f40d14d8012c43e0cf0e841
- http://ms#####.#allas.feralhosting.com/b9e6dd4de7f79fa37836774d2474253c
- http://18#.#5.48.68/02ed55faea5d1d2b1490e78da30da107/5fc741325308c0e741e9509ed5d
- http://18#.#5.48.68/02ed55faea5d1d2b1490e78da30da107/fc324f595608bf3e9809c401917f9a6900977
- http://pa###bin.com/raw/h5yBCwpY
- http://pa###bin.com/raw/HNkipzLK
- http://pa###bin.com/raw/qdwMGvDS
Other
- '18#.#5.48.68':443
- 'pa###bin.com':443
UDP
- DNS ASK ms#####.#ion.feralhosting.com
- DNS ASK ms#####.#allas.feralhosting.com
- DNS ASK pa###bin.com
Miscellaneous
Searches for the following windows
- ClassName: 'SystemTray_Main' WindowName: ''
