Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'CSRSS' = '"%ALLUSERSPROFILE%\Drivers\csrss.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 384dc723fac37ef7
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\PowerGo 65.0 Build 2191 Essential] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\PowerGo 65.0 Build 2191 Essential] 'ImagePath' = '%ALLUSERSPROFILE%\PowerGo 65.0 Build 2191 Essential\PowerGo 65.0 Build 2191 Essential.exe'
Creates the following services
- 'PowerGo 65.0 Build 2191 Essential' %ALLUSERSPROFILE%\PowerGo 65.0 Build 2191 Essential\PowerGo 65.0 Build 2191 Essential.exe
Modifies master boot record (MBR).
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Injects code into
the following user processes:
- b644.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %APPDATA%\dgfburh
- %LOCALAPPDATA%\dvd slow\languages\is-4bfvc.tmp
- %LOCALAPPDATA%\dvd slow\is-ev0hr.tmp
- %LOCALAPPDATA%\dvd slow\unins000.dat
- %TEMP%\nsc39d5.tmp\inetc.dll
- %LOCALAPPDATA%\dvd slow\dvdslow.exe
- %TEMP%\4kpv6a~1\unverified-microdesc-consensus.tmp
- %TEMP%\42fd.dll
- %TEMP%\4kpv6a~1\cached-certs.tmp
- %TEMP%\4kpv6a~1\cached-microdesc-consensus.tmp
- %TEMP%\nsn5581.tmp
- %TEMP%\broomsetup.exe
- %LOCALAPPDATA%\dvd slow\is-jn3l4.tmp
- %TEMP%\4kpv6a~1\cached-microdescs.new
- %ALLUSERSPROFILE%\akkkecbkkecgcaaaehjk
- %ALLUSERSPROFILE%\hdakjdhi
- %ALLUSERSPROFILE%\freebl3.dll
- %ALLUSERSPROFILE%\mozglue.dll
- %ALLUSERSPROFILE%\msvcp140.dll
- %ALLUSERSPROFILE%\nss3.dll
- %ALLUSERSPROFILE%\softokn3.dll
- %ALLUSERSPROFILE%\vcruntime140.dll
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cookies.sqlite-shm
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\places.sqlite-shm
- %ALLUSERSPROFILE%\akebfcfijjkkecakjehdaafieg
- %ALLUSERSPROFILE%\powergo 65.0 build 2191 essential\powergo 65.0 build 2191 essential.exe
- %LOCALAPPDATA%\dvd slow\is-ut814.tmp
- %LOCALAPPDATA%\dvd slow\is-j3vn0.tmp
- %LOCALAPPDATA%\dvd slow\is-dmo1q.tmp
- %ALLUSERSPROFILE%\drivers\csrss.exe
- %TEMP%\c4f4.exe
- %TEMP%\4kpv6a~1\state.tmp
- %TEMP%\fd92.exe
- %TEMP%\288c47bbc1871b439df19ff4df68f076.exe
- %TEMP%\16cd.exe
- %TEMP%\installsetup4.exe
- %TEMP%\is-ch25f.tmp\16cd.tmp
- %TEMP%\fourthx.exe
- %TEMP%\20cd.exe
- %TEMP%\is-9b6st.tmp\_isetup\_setup64.tmp
- %TEMP%\b644.exe
- %TEMP%\is-9b6st.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-9b6st.tmp\_isetup\_iscrypt.dll
- %LOCALAPPDATA%\dvd slow\is-m0glp.tmp
- %LOCALAPPDATA%\dvd slow\is-qq6fb.tmp
- %LOCALAPPDATA%\dvd slow\is-4bk1f.tmp
- %LOCALAPPDATA%\dvd slow\is-2i2n9.tmp
- %LOCALAPPDATA%\dvd slow\is-s2acj.tmp
- %LOCALAPPDATA%\dvd slow\is-ijg0d.tmp
- %LOCALAPPDATA%\dvd slow\is-iqgho.tmp
- %LOCALAPPDATA%\dvd slow\is-o9hfn.tmp
- %LOCALAPPDATA%\dvd slow\is-2vl9q.tmp
- %LOCALAPPDATA%\dvd slow\is-chc1e.tmp
- %TEMP%\is-9b6st.tmp\_isetup\_isdecmp.dll
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\cookies.sqlite-shm
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\places.sqlite-shm
Sets the 'hidden' attribute to the following files
- %APPDATA%\dgfburh
- %ALLUSERSPROFILE%\drivers\csrss.exe
Deletes the following files
- %LOCALAPPDATA%\dvd slow\libgcc_s_dw2-1.dll
- %TEMP%\4kpv6a~1\unverified-microdesc-consensus
- %ALLUSERSPROFILE%\akebfcfijjkkecakjehdaafieg
- %ALLUSERSPROFILE%\akkkecbkkecgcaaaehjk
- %ALLUSERSPROFILE%\hdakjdhi
- %TEMP%\4kpv6a~1\state
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cookies.sqlite-shm
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\places.sqlite-shm
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\cookies.sqlite-shm
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\places.sqlite-shm
Moves the following files
- from %TEMP%\4kpv6a~1\state.tmp to %TEMP%\4kpv6a~1\state
- from %TEMP%\4kpv6a~1\unverified-microdesc-consensus.tmp to %TEMP%\4kpv6a~1\unverified-microdesc-consensus
- from %LOCALAPPDATA%\dvd slow\is-ev0hr.tmp to %LOCALAPPDATA%\dvd slow\dvdslow.exe
- from %LOCALAPPDATA%\dvd slow\languages\is-4bfvc.tmp to %LOCALAPPDATA%\dvd slow\languages\turkish.ini
- from %LOCALAPPDATA%\dvd slow\is-jn3l4.tmp to %LOCALAPPDATA%\dvd slow\setting.ini
- from %LOCALAPPDATA%\dvd slow\is-ut814.tmp to %LOCALAPPDATA%\dvd slow\sdl2.dll
- from %LOCALAPPDATA%\dvd slow\is-j3vn0.tmp to %LOCALAPPDATA%\dvd slow\swresample-3.dll
- from %LOCALAPPDATA%\dvd slow\is-dmo1q.tmp to %LOCALAPPDATA%\dvd slow\zlib1.dll
- from %TEMP%\4kpv6a~1\cached-certs.tmp to %TEMP%\4kpv6a~1\cached-certs
- from %LOCALAPPDATA%\dvd slow\is-chc1e.tmp to %LOCALAPPDATA%\dvd slow\libbz2-1.dll
- from %LOCALAPPDATA%\dvd slow\is-o9hfn.tmp to %LOCALAPPDATA%\dvd slow\libvorbisenc-2.dll
- from %LOCALAPPDATA%\dvd slow\is-iqgho.tmp to %LOCALAPPDATA%\dvd slow\libvorbis-0.dll
- from %LOCALAPPDATA%\dvd slow\is-ijg0d.tmp to %LOCALAPPDATA%\dvd slow\libogg-0.dll
- from %LOCALAPPDATA%\dvd slow\is-s2acj.tmp to %LOCALAPPDATA%\dvd slow\libiconv-2.dll
- from %LOCALAPPDATA%\dvd slow\is-4bk1f.tmp to %LOCALAPPDATA%\dvd slow\avutil-56.dll
- from %LOCALAPPDATA%\dvd slow\is-qq6fb.tmp to %LOCALAPPDATA%\dvd slow\libgcc_s_dw2-1.dll
- from %LOCALAPPDATA%\dvd slow\is-m0glp.tmp to %LOCALAPPDATA%\dvd slow\unins000.exe
- from %LOCALAPPDATA%\dvd slow\is-2vl9q.tmp to %LOCALAPPDATA%\dvd slow\libwinpthread-1.dll
- from %TEMP%\4kpv6a~1\cached-microdesc-consensus.tmp to %TEMP%\4kpv6a~1\cached-microdesc-consensus
Modifies the following files
Substitutes the following files
- %LOCALAPPDATA%\dvd slow\libgcc_s_dw2-1.dll
- %TEMP%\4kpv6a~1\state.tmp
- %TEMP%\4kpv6a~1\state
Deletes itself.
Network activity
Connects to
- 'se####ation17io.io':80
- '18#.#72.128.127':80
- '18#.#72.128.90':80
- '31.##1.154.162':443
- '65.##8.108.198':9001
- '19#.#8.81.140':443
- '16#.#6.94.107':9001
- '18#.#72.128.145':80
- 'en.##stsup.su':80
- '85.##5.208.154':9001
- '91.##1.86.59':993
- '18#.#5.205.10':443
- '19#.#01.29.252':9001
- 'localhost':49183
- '18#.#72.128.19':80
- 'tr##c.com':80
- 'localhost':44541
TCP
HTTP GET requests
- http://18#.#72.128.19/288c47bbc1871b439df19ff4df68f0776.exe
- http://tr##c.com/check/index.php
- http://en.##stsup.su/data/pdf/may.exe
- http://18#.#72.128.90/cpa/ping.php?su##############
- http://18#.#72.128.127/syncUpd.exe
- http://18#.#72.128.145/15f649199f40275b/sqlite3.dll
- http://18#.#72.128.145/15f649199f40275b/freebl3.dll
- http://18#.#72.128.145/15f649199f40275b/mozglue.dll
- http://18#.#72.128.145/15f649199f40275b/msvcp140.dll
- http://18#.#72.128.145/15f649199f40275b/nss3.dll
- http://18#.#72.128.145/15f649199f40275b/softokn3.dll
- http://18#.#72.128.145/15f649199f40275b/vcruntime140.dll
HTTP POST requests
- http://se####ation17io.io/index.php
Other
- '18#.#5.205.10':443
- '91.##1.86.59':993
- '19#.#8.81.140':443
- '65.##8.108.198':9001
- '31.##1.154.162':443
- 'localhost':44541
- 'localhost':49199
UDP
- DNS ASK se####ation17io.io
- DNS ASK tr##c.com
- DNS ASK en.##stsup.su
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'zaa919_Flash2251FixClass_zaa919'
- ClassName: 'msctls_updown32' WindowName: ''
Creates and executes the following
- '%TEMP%\b644.exe'
- '%TEMP%\c4f4.exe'
- '%TEMP%\fd92.exe'
- '%TEMP%\288c47bbc1871b439df19ff4df68f076.exe'
- '%TEMP%\16cd.exe'
- '%TEMP%\installsetup4.exe'
- '%TEMP%\is-ch25f.tmp\16cd.tmp' /SL5="$10266,4185251,54272,%TEMP%\16CD.exe"
- '%TEMP%\fourthx.exe'
- '%TEMP%\20cd.exe'
- '%TEMP%\broomsetup.exe'
- '%LOCALAPPDATA%\dvd slow\dvdslow.exe' -i
- '%TEMP%\nsn5581.tmp'
- '%LOCALAPPDATA%\dvd slow\dvdslow.exe' -s
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\Temp\Task.bat" "' (with hidden window)
Executes the following
- '<SYSTEM32>\regsvr32.exe' /s %TEMP%\42FD.dll
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\Temp\Task.bat" "
- '<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' delete "UTIXDCVF"
- '%WINDIR%\syswow64\chcp.com' 1251
- '<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
- '<SYSTEM32>\sc.exe' create "UTIXDCVF" binpath= "%ALLUSERSPROFILE%\xcfonrchdkar\vueqjgslwynd.exe" start= "auto"
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "MalayamaraUpdate" /tr "'%TEMP%\Updater.exe'" /sc minute /mo 30 /F
