Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d9' = '%APPDATA%\1e6f17d9.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d' = 'C:\1e6f17d9\1e6f17d9.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\1e6f17d9.exe
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
Executes the following:
- '<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet
- '<SYSTEM32>\svchost.exe' netsvcs
- '%WINDIR%\explorer.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system :
Creates the following files:
- %APPDATA%\1e6f17d9.exe
- C:\1e6f17d9\1e6f17d9.exe
Network activity:
Connects to:
- 'ou###ve3344.com':80
- 'un#####developer3.com':80
- 'tu##ck.com':80
- 'th####drona.co.nz':80
- 'wi#####stgallery.com':80
- 'to######lichnhatrang.com':80
- 'li#####le-journal.org':80
- 'ka####arehberi.com':80
- 'we########rretirementservices.com':80
- 'al###o.com.co':80
- 'hk####riors.co.uk':80
- 'cr####helametine.it':80
- 'ca######ibeachsoccer.com':80
- 'ip###otami.net':80
- 'we####ignlivorno.it':80
- 'li#####-counselling.com':80
- 'or#z.tw':80
- 'tu####alswalk.info':80
- 'cr###racker.com':80
- 'da###media.com':80
- 'sw#####sopticians.com':80
- 'ya##pan.com':80
- 'my####rnalip.com':80
- 'ip##ddr.es':80
- 're###tefarm.com':80
- 'cu###yip.com':80
- 'vi####ngjakarta.com':80
- 'wa###athore.com':80
- 'cs##d.com':80
- 'co###ul.com.br':80
- 'st###yhub.com':80
- 'xa###czl.com':80
- 'vi####gameworld.com':80
- 'st###emes.com':80
- 'ca###szeko.com':80
TCP:
HTTP GET requests:
- http://cu###yip.com/
- http://my####rnalip.com/raw
- http://ip##ddr.es/
HTTP POST requests:
- http://th####drona.co.nz/wp-content/themes/roots-master/img4.php?v=##########
- http://ou###ve3344.com/wp-content/themes/village/img5.php?m=##########
- http://we########rretirementservices.com/wp-content/plugins/revslider/temp/update_extract/revslider/img4.php?b=##########
- http://tu##ck.com/wp-content/plugins/wp_module/img5.php?s=##########
- http://ka####arehberi.com/wp-content/plugins/wp_module/img2.php?g=##########
- http://wi#####stgallery.com/wp-content/plugins/revslider/temp/update_extract/revslider/img4.php?a=##########
- http://un#####developer3.com/wp-content/plugins/wp_module/img3.php?z=##########
- http://li#####le-journal.org/wp-content/plugins/wp_module/img1.php?t=##########
- http://al###o.com.co/site/wp-content/themes/alimco/img2.php?a=##########
- http://hk####riors.co.uk/wp-content/plugins/wp_module/img5.php?t=##########
- http://cr####helametine.it/ciccioesse/img1.php?a=##########
- http://ca######ibeachsoccer.com/wp-content/plugins/wp_module/img2.php?z=##########
- http://ip###otami.net/wp-content/plugins/wp_module/img5.php?g=##########
- http://we####ignlivorno.it/wp-content/themes/newscast/img4.php?c=##########
- http://li#####-counselling.com/wp-content/plugins/wp_module/img2.php?x=##########
- http://or#z.tw/wp-content/plugins/wp_module/img1.php?u=##########
- http://vi####ngjakarta.com/wp-content/plugins/wp_module/img3.php?b=##########
- http://sw#####sopticians.com/wp-content/plugins/wp_module/img1.php?r=##########
- http://xa###czl.com/wp-content/plugins/wp_module/img3.php?k=##########
- http://vi####gameworld.com/wp-content/plugins/wp_module/img1.php?k=##########
- http://da###media.com/wp-content/plugins/wp_module/img5.php?s=##########
- http://re###tefarm.com/img4.php?k=##########
- http://ya##pan.com/wp-content/uploads/2015/03/img2.php?w=##########
- http://cr###racker.com/wp-content/themes/twentytwelve/img2.php?m=##########
- http://co###ul.com.br/wp-content/plugins/wp_module/img1.php?f=##########
- http://st###yhub.com/wp-content/plugins/wp_module/img5.php?y=##########
- http://to######lichnhatrang.com/wp-content/plugins/wp_module/img1.php?z=##########
- http://tu####alswalk.info/wp-content/themes/Defne/img2.php?c=##########
- http://st###emes.com/wp-content/themes/twentytwelve/img3.php?p=##########
- http://ca###szeko.com/wp-content/plugins/revslider/temp/update_extract/revslider/img3.php?n=##########
- http://wa###athore.com/wp-content/themes/meshable/img4.php?c=##########
- http://cs##d.com/wp-content/themes/spacious/img1.php?o=##########
UDP:
- DNS ASK ou###ve3344.com
- DNS ASK un#####developer3.com
- DNS ASK tu##ck.com
- DNS ASK th####drona.co.nz
- DNS ASK wi#####stgallery.com
- DNS ASK to######lichnhatrang.com
- DNS ASK li#####le-journal.org
- DNS ASK ka####arehberi.com
- DNS ASK we########rretirementservices.com
- DNS ASK al###o.com.co
- DNS ASK hk####riors.co.uk
- DNS ASK cr####helametine.it
- DNS ASK ca######ibeachsoccer.com
- DNS ASK ip###otami.net
- DNS ASK we####ignlivorno.it
- DNS ASK li#####-counselling.com
- DNS ASK or#z.tw
- DNS ASK tu####alswalk.info
- DNS ASK cr###racker.com
- DNS ASK da###media.com
- DNS ASK sw#####sopticians.com
- DNS ASK ya##pan.com
- DNS ASK my####rnalip.com
- DNS ASK ip##ddr.es
- DNS ASK re###tefarm.com
- DNS ASK cu###yip.com
- DNS ASK vi####ngjakarta.com
- DNS ASK wa###athore.com
- DNS ASK cs##d.com
- DNS ASK co###ul.com.br
- DNS ASK st###yhub.com
- DNS ASK xa###czl.com
- DNS ASK vi####gameworld.com
- DNS ASK st###emes.com
- DNS ASK ca###szeko.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
