Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Client Server Runtime Process' = '%LOCALAPPDATA%\csr_hostsvc.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath '%LOCALAPPDATA%'
Searches for windows to
detect analytical utilities:
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
Modifies file system
Creates the following files
- %LOCALAPPDATA%\csr_hostsvc.exe
- %TEMP%\evbc8df.tmp
- %TEMP%\evbc8ff.tmp
- %LOCALAPPDATA%\screenshot.png
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\csr_hostsvc.exe
Deletes following files that it created itself
- %LOCALAPPDATA%\screenshot.png
Network activity
Connects to
- 'ap#.#pify.org':443
- 'ap#.##legram.org':443
TCP
Other
- 'ap#.#pify.org':443
- 'ap#.##legram.org':443
UDP
- DNS ASK ap#.#pify.org
- DNS ASK ap#.##legram.org
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
Creates and executes the following
- '%LOCALAPPDATA%\csr_hostsvc.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c start "" "%LOCALAPPDATA%\csr_hostsvc.exe"
