Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Windows Host' = '%HOMEPATH%\Pictures\svchost.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsSvcHost' = '%LOCALAPPDATA%\Microsoft\WindowsApps\WindowsStore.Update.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdate' = '%APPDATA%\winsysdrv.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'czssa' = '%ALLUSERSPROFILE%\xvnbu.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdateManager' = '%TEMP%\apzdgkjz.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\windowsupdate
- <SYSTEM32>\tasks\windows security checks
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\EmbeddedDriverService] 'ImagePath' = '%TEMP%\EmbeddedDriverService.sys'
Creates the following services
- 'EmbeddedDriverService' %TEMP%\EmbeddedDriverService.sys
Creates the following files on removable media
- <Drive name for removable media>:\update.exe
- <Drive name for removable media>:\documents.lnk
- <Drive name for removable media>:\work_report_2026.pdf.lnk
- <Drive name for removable media>:\vacation_photos.lnk
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- file extensions
blocks execution of the following system utilities:
- Windows Security Center
- Windows Defender
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
- <SYSTEM32>\sihost.exe
- <SYSTEM32>\taskhostw.exe
- <SYSTEM32>\runtimebroker.exe
the following user processes:
- firefox.exe
Hooks functions
in browsers
- firefox.exe process, nss3.dll module
Patches code
in AMSI dll
- 5g515uuh.exe process, Amsi.dll module
- 0_957312.exe process, Amsi.dll module
in NTDLL dll
- 5g515uuh.exe process, ntdll.dll module
- 0_957312.exe process, ntdll.dll module
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\securityhealthsystray.exe
- <SYSTEM32>\securityhealthservice.exe
Modifies file system
Creates the following files
- %TEMP%\hz6teis2.exe
- %TEMP%\aku40j44.exe
- %TEMP%\8zf8bifs.exe
- %TEMP%\winsyskdrv.exe
- %TEMP%\6ct90dlu.exe
- %HOMEPATH%\pictures\svchost.exe
- %TEMP%\573rvvat.exe
- %LOCALAPPDATA%\microsoft\windowsapps\windowsstore.update.exe
- %TEMP%\vsruntime17344.tmp
- %TEMP%\apzdgkjz.exe
- %TEMP%\embeddeddriverservice.sys
- %APPDATA%\winsysdrv.exe
- %TEMP%\s0411gjv.exe
- %TEMP%\5g515uuh.exe
- %TEMP%\0_957312.exe
- %APPDATA%\dwrvc.exe
- %APPDATA%\microsoft\windows\services\winhost.exe
- %ALLUSERSPROFILE%\xvnbu.exe
- %TEMP%\1_964500.exe
- %TEMP%\hjrx0gfv.exe
- %TEMP%\2_969140.exe
- %HOMEPATH%\update.exe
- %HOMEPATH%\desktop\my documents.lnk
- %HOMEPATH%\desktop\downloads.lnk
- %HOMEPATH%\desktop\work files.lnk
- %HOMEPATH%\desktop\shared photos.lnk
- %HOMEPATH%\.oracle_jre_usage\update.exe
- %HOMEPATH%\.oracle_jre_usage\.oracle_jre_usage - files.lnk
- %HOMEPATH%\3d objects\update.exe
- %HOMEPATH%\3d objects\3d objects - files.lnk
- %HOMEPATH%\contacts\update.exe
- %HOMEPATH%\contacts\contacts - files.lnk
- %HOMEPATH%\desktop\update.exe
- %HOMEPATH%\desktop\desktop - files.lnk
- %HOMEPATH%\documents\update.exe
- %HOMEPATH%\documents\documents - files.lnk
- %HOMEPATH%\downloads\update.exe
- %HOMEPATH%\downloads\downloads - files.lnk
- %HOMEPATH%\favorites\update.exe
- %HOMEPATH%\favorites\favorites - files.lnk
- %HOMEPATH%\favorites\links\update.exe
- %HOMEPATH%\favorites\links\links - files.lnk
- %HOMEPATH%\links\update.exe
- %HOMEPATH%\links\links - files.lnk
- %HOMEPATH%\music\update.exe
- %HOMEPATH%\music\music - files.lnk
- %HOMEPATH%\pictures\update.exe
- %HOMEPATH%\pictures\pictures - files.lnk
- %HOMEPATH%\pictures\camera roll\update.exe
- %HOMEPATH%\pictures\camera roll\camera roll - files.lnk
- %HOMEPATH%\saved games\update.exe
- %HOMEPATH%\saved games\saved games - files.lnk
- %HOMEPATH%\searches\update.exe
- %HOMEPATH%\searches\searches - files.lnk
- %HOMEPATH%\videos\update.exe
- %HOMEPATH%\videos\videos - files.lnk
- D:\update.exe
- %TEMP%\rcxat5gq.exe
Sets the 'hidden' attribute to the following files
- %TEMP%\hz6teis2.exe
- %TEMP%\aku40j44.exe
- %TEMP%\8zf8bifs.exe
- %TEMP%\winsyskdrv.exe
- %TEMP%\6ct90dlu.exe
- %HOMEPATH%\pictures\svchost.exe
- %TEMP%\573rvvat.exe
- %LOCALAPPDATA%\microsoft\windowsapps\windowsstore.update.exe
- %TEMP%\vsruntime17344.tmp
- %TEMP%\apzdgkjz.exe
- %APPDATA%\winsysdrv.exe
- %TEMP%\s0411gjv.exe
- %TEMP%\5g515uuh.exe
- %APPDATA%\microsoft\windows\services\winhost.exe
- %ALLUSERSPROFILE%\xvnbu.exe
- %HOMEPATH%\update.exe
- %HOMEPATH%\.oracle_jre_usage\update.exe
- %HOMEPATH%\3d objects\update.exe
- %HOMEPATH%\contacts\update.exe
- %HOMEPATH%\desktop\update.exe
- %HOMEPATH%\documents\update.exe
- %HOMEPATH%\downloads\update.exe
- %HOMEPATH%\favorites\update.exe
- %HOMEPATH%\favorites\links\update.exe
- %HOMEPATH%\links\update.exe
- %HOMEPATH%\music\update.exe
- %HOMEPATH%\pictures\update.exe
- %HOMEPATH%\pictures\camera roll\update.exe
- %HOMEPATH%\saved games\update.exe
- %HOMEPATH%\searches\update.exe
- %HOMEPATH%\videos\update.exe
- D:\update.exe
- <Drive name for removable media>:\update.exe
Modifies the HOSTS file.
Network activity
Connects to
- '19#.#51.107.130':80
- '62.##.226.159':80
TCP
HTTP GET requests
- http://62.##.226.159/data.php?hw#################################################################################################################################################################...
- http://62.##.226.159/uploads/zQAXJLrhOrPH.exe
HTTP POST requests
- http://19#.#51.107.130/16b022998f754137b60a.php
- http://62.##.226.159/xvzpjyddlu/getdata.php
Miscellaneous
Creates and executes the following
- '%TEMP%\hz6teis2.exe'
- '%TEMP%\aku40j44.exe'
- '%TEMP%\8zf8bifs.exe'
- '%TEMP%\6ct90dlu.exe'
- '%TEMP%\573rvvat.exe'
- '%TEMP%\winsyskdrv.exe'
- '%TEMP%\apzdgkjz.exe'
- '%TEMP%\s0411gjv.exe'
- '%TEMP%\5g515uuh.exe'
- '%APPDATA%\dwrvc.exe'
- '%TEMP%\0_957312.exe'
- '%ALLUSERSPROFILE%\xvnbu.exe'
- '%TEMP%\hjrx0gfv.exe'
- '%TEMP%\1_964500.exe'
- '%TEMP%\2_969140.exe'
- '%TEMP%\rcxat5gq.exe'
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "WindowsUpdate" /tr "%APPDATA%\winsysdrv.exe" /sc onlogon /rl highest /f
- '%TEMP%\hz6teis2.exe' ' (with hidden window)
- '%TEMP%\aku40j44.exe' ' (with hidden window)
- '%TEMP%\8zf8bifs.exe' ' (with hidden window)
- '%TEMP%\6ct90dlu.exe' ' (with hidden window)
- '%TEMP%\573rvvat.exe' ' (with hidden window)
- '%TEMP%\apzdgkjz.exe' ' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "WindowsUpdate" /tr "%APPDATA%\winsysdrv.exe" /sc onlogon /rl highest /f' (with hidden window)
- '%TEMP%\s0411gjv.exe' ' (with hidden window)
- '%TEMP%\5g515uuh.exe' ' (with hidden window)
- '%TEMP%\0_957312.exe' ' (with hidden window)
- '%ALLUSERSPROFILE%\xvnbu.exe' ' (with hidden window)
- '%TEMP%\1_964500.exe' ' (with hidden window)
- '%TEMP%\2_969140.exe' ' (with hidden window)
