Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'haleng' = '%TEMP%\haleng.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Host' = '%ALLUSERSPROFILE%\Windows Host\Windows Host.exe'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe
Modifies file system
Creates the following files
- %TEMP%\is-14hiq.tmp\<File name>.tmp
- %TEMP%\is-f1b4g.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-f1b4g.tmp\idp.dll
- %TEMP%\is-8aris.tmp\_isetup\_setup64.tmp
- %TEMP%\is-8aris.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-8aris.tmp\idp.dll
- %ProgramFiles%\patch.dat
- %ProgramFiles%\patch.dll
- %TEMP%\is-f1b4g.tmp\jenjoon.exe
- %TEMP%\is-8aris.tmp\redstar.exe
- %TEMP%\jfiag3g_gg.exe
- %TEMP%\fj4ghga23_fsa.txt
- %ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\d
- %ALLUSERSPROFILE%\5046343.exe
- %ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\d-shm
- %ALLUSERSPROFILE%\3501960.exe
- %ALLUSERSPROFILE%\1122676.exe
- %ALLUSERSPROFILE%\windows host\windows host.exe
- %TEMP%\is-f1b4g.tmp\_isetup\_setup64.tmp
- %ALLUSERSPROFILE%\6984815.exe
- %TEMP%\is-7uua4.tmp\labpicv3.tmp
- %HOMEPATH%\documents\vlcpvideov1.0.1\jg7_7wjg.exe
- %TEMP%\is-m6u85.tmp\_isetup\_setup64.tmp
- %TEMP%\is-m6u85.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-m6u85.tmp\itdownload.dll
- %TEMP%\is-m6u85.tmp\setup.exe
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
- %ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\runww.exe
- %ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\hjjgaa.exe
- %ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\jg7_7wjg.exe
- %ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\guihuali-game.exe
- %ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\labpicv3.exe
- %ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\lylal220.exe
- %ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\barsetpfile.exe
- %ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\dp81gdx0orcq.exe
- %ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\uninstall.exe
- %ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\uninstall.ini
- %TEMP%\is-j7qhf.tmp\lylal220.tmp
- %TEMP%\haleng.exe
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cookies.sqlite.tmp-shm
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\windows host\windows host.exe
Deletes the following files
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\is-f1b4g.tmp\_isetup\_setup64.tmp
- %TEMP%\is-f1b4g.tmp\jenjoon.exe
- %TEMP%\is-f1b4g.tmp\idp.dll
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cookies.sqlite.tmp-shm
- %TEMP%\is-7uua4.tmp\labpicv3.tmp
- %TEMP%\is-8aris.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-8aris.tmp\_isetup\_setup64.tmp
- %TEMP%\is-f1b4g.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-8aris.tmp\redstar.exe
- %TEMP%\fj4ghga23_fsa.txt
- %TEMP%\jfiag3g_gg.exe
- %ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\d-shm
- %ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\d
- %ProgramFiles%\patch.dat
- %TEMP%\is-14hiq.tmp\<File name>.tmp
- %TEMP%\$inst\2.tmp
- %TEMP%\is-8aris.tmp\idp.dll
- %TEMP%\is-j7qhf.tmp\lylal220.tmp
Substitutes the following files
- %ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\d
- %ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\d-shm
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cookies.sqlite.tmp-shm
Network activity
Connects to
- 'ip##fo.io':80
- 'ip##fo.io':443
- 'pr###check.io':80
- '3b################-a716-d0986744cc54.s3.ap-south-1.amazonaws.com':80
- 'sc####.##ogleusercontent.com':443
- 'script.google.com':443
- '10#.#6.107.74':80
- 'ip###ger.org':443
- 'gl####-sc-ltd.com':80
- 'ap#.#aceit.com':443
- 'ip##pi.com':80
- 'co###ctini.net':443
- 'microsoft.com':80
- 'fa###ook.com':443
TCP
HTTP GET requests
- http://ip##fo.io/ip
UDP
- DNS ASK ip##fo.io
- DNS ASK microsoft.com
- DNS ASK co###ctini.net
- DNS ASK pi###-dcn.xyz
- DNS ASK ip##pi.com
- DNS ASK
- DNS ASK
- DNS ASK
- DNS ASK ap#.#aceit.com
- DNS ASK gl####-sc-ltd.com
- DNS ASK ip###ger.org
- DNS ASK script.google.com
- DNS ASK sc####.##ogleusercontent.com
- DNS ASK 3b################-a716-d0986744cc54.s3.ap-south-1.amazonaws.com
- DNS ASK pr###check.io
- DNS ASK fa#####k.websmails.com
- DNS ASK fa###ook.com
- 'fa#####k.websmails.com':53
Miscellaneous
Creates and executes the following
- '%TEMP%\is-14hiq.tmp\<File name>.tmp' /SL5="$110234,138429,56832,<Full path to file>"
- '%ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\lylal220.exe'
- '%TEMP%\is-7uua4.tmp\labpicv3.tmp' /SL5="$300C8,506086,422400,%ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe"
- '%TEMP%\is-j7qhf.tmp\lylal220.tmp' /SL5="$20268,506127,422400,%ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe"
- '%ALLUSERSPROFILE%\5046343.exe'
- '%ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\dp81gdx0orcq.exe'
- '%ALLUSERSPROFILE%\3501960.exe'
- '%ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\barsetpfile.exe'
- '%ALLUSERSPROFILE%\1122676.exe'
- '%TEMP%\is-f1b4g.tmp\jenjoon.exe' /S /UID=lylal220
- '%TEMP%\is-8aris.tmp\redstar.exe' /S /UID=lab214
- '%ALLUSERSPROFILE%\windows host\windows host.exe'
- '%ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\guihuali-game.exe'
- '%ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\jg7_7wjg.exe'
- '%ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\runww.exe'
- '%ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\hjjgaa.exe'
- '%TEMP%\is-m6u85.tmp\setup.exe' /Verysilent
- '%TEMP%\jfiag3g_gg.exe' /scookiestxt %TEMP%\fj4ghga23_fsa.txt
- '%ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\labpicv3.exe'
- '%TEMP%\is-8aris.tmp\redstar.exe' /S /UID=lab214' (with hidden window)
- '<SYSTEM32>\cmd.exe' /k %TEMP%\ndhbmi5t.cg2\instEU.exe & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /k %TEMP%\ziszab50.yqs\instEU.exe & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /k %TEMP%\pz3beku2.fgc\gpooe.exe & exit' (with hidden window)
- '%TEMP%\jfiag3g_gg.exe' /scookiestxt %TEMP%\fj4ghga23_fsa.txt' (with hidden window)
- '%ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\dp81gdx0orcq.exe' ' (with hidden window)
- '%TEMP%\is-f1b4g.tmp\jenjoon.exe' /S /UID=lylal220' (with hidden window)
- '%ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\guihuali-game.exe' ' (with hidden window)
- '%ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\barsetpfile.exe' ' (with hidden window)
- '%ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\lylal220.exe' ' (with hidden window)
- '%ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\labpicv3.exe' ' (with hidden window)
- '%ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\jg7_7wjg.exe' ' (with hidden window)
- '%ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\runww.exe' ' (with hidden window)
- '%ProgramFiles(x86)%\94c45254-6d52-40cc-93fb-b69707383880\versium research\hjjgaa.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /k %TEMP%\xyfao123.os1\google-game.exe & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /k %TEMP%\d14hlp5h.hao\gpooe.exe & exit' (with hidden window)
- '<SYSTEM32>\cmd.exe' /k %TEMP%\zfrmnton.4gr\google-game.exe & exit' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles%\patch.dll",patch
- '<SYSTEM32>\svchost.exe' -k SystemNetworkService
- '%WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe'
- '%WINDIR%\syswow64\cmd.exe' /C reg addВ HKEY_CURRENT_USER\Software\DataFinder\keycheck /vВ Status /tВ REG_DWORDВ /dВ 1 && reg addВ HKEY_CURRENT_USER\Software\DataFinder\VersiumResearch /vВ Status /tВ REG_DWORDВ /dВ 1
- '%WINDIR%\syswow64\reg.exe' addВ HKEY_CURRENT_USER\Software\DataFinder\keycheck /vВ Status /tВ REG_DWORDВ /dВ 1
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' https://www.pr#######etrustednetwork.com/e2q8zu9hu?ke##################################
- '<SYSTEM32>\cmd.exe' /k %TEMP%\ndhbmi5t.cg2\instEU.exe & exit
- '<SYSTEM32>\cmd.exe' /k %TEMP%\ziszab50.yqs\instEU.exe & exit
- '<SYSTEM32>\cmd.exe' /k %TEMP%\pz3beku2.fgc\gpooe.exe & exit
- '<SYSTEM32>\cmd.exe' /k %TEMP%\d14hlp5h.hao\gpooe.exe & exit
- '<SYSTEM32>\cmd.exe' /k %TEMP%\xyfao123.os1\google-game.exe & exit
- '<SYSTEM32>\cmd.exe' /k %TEMP%\zfrmnton.4gr\google-game.exe & exit
