Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d9' = '%APPDATA%\1e6f17d9.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d' = 'C:\1e6f17d9\1e6f17d9.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\1e6f17d9.exe
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
- Windows Security Center
blocks the following features:
- System Restore (SR)
deletes volume shadow copies.
Executes the following:
- '<SYSTEM32>\svchost.exe' netsvcs
- '%WINDIR%\explorer.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system:
Creates the following files:
- %APPDATA%\1e6f17d9.exe
- C:\1e6f17d9\1e6f17d9.exe
Network activity:
Connects to:
- 're###ilir.com':80
- 'ja####selink.net':80
- 'ze####mstudio.com':80
- 'su###hamali.com':80
- 'be###rcatch.com':80
- 'cr#######ibraryfoundation.org':80
- 'ev######arketinggroup.com':80
- 'im###ging.info':80
- 'ju####nd-reach.com':80
- 'ea###ain.com':80
- 'ca###ahpt.com':80
- 'sf##j.org':80
- 'cu###cores.com':80
- 'ka####serbia.org':80
- 'pi###jokes.org':80
- 'ma##m.com':80
- 'si#####rventures.com':80
- 'sk###nts.com':80
- 'ca###oc-bg.com':80
- 'ip##ddr.es':80
- 'my####rnalip.com':80
- 'cu###yip.com':80
- 'vo####irtuelle.com':80
- 'km##ich.com':80
- 'ii##avi.net':80
- 're#####sprinter.info':80
- 'df###moilou.com':80
- 'he##.net':80
- 'gd###rit.com':80
TCP:
HTTP GET requests:
- http://cu###yip.com/
- http://my####rnalip.com/raw
- http://ip##ddr.es/
HTTP POST requests:
- http://re###ilir.com/img4.php?q=#############
- http://ja####selink.net/img1.php?t=#############
- http://ze####mstudio.com/img5.php?t=#############
- http://cr#######ibraryfoundation.org/img2.php?e=#############
- http://ev######arketinggroup.com/image/img5.php?m=#############
- http://su###hamali.com/img5.php?x=#############
- http://sf##j.org/img3.php?a=#############
- http://im###ging.info/img1.php?m=#############
- http://ju####nd-reach.com/cgi-bin/img3.php?k=#############
- http://ea###ain.com/img2.php?k=#############
- http://cu###cores.com/img5.php?l=#############
- http://ka####serbia.org/img1.php?x=#############
- http://ca###ahpt.com/img2.php?i=#############
- http://sk###nts.com/img3.php?m=#############
- http://df###moilou.com/img5.php?w=#############
- http://he##.net/img3.php?j=#############
- http://ca###oc-bg.com/img2.php?d=#############
- http://ma##m.com/img3.php?t=#############
- http://si#####rventures.com/img2.php?a=#############
- http://gd###rit.com/img4.php?n=#############
- http://ii##avi.net/img4.php?e=#############
- http://pi###jokes.org/img1.php?y=#############
- http://be###rcatch.com/cms/img4.php?z=#############
- http://re#####sprinter.info/img1.php?s=#############
- http://vo####irtuelle.com/img1.php?u=#############
- http://km##ich.com/cgi-bin/img2.php?j=#############
UDP:
- DNS ASK re###ilir.com
- DNS ASK ja####selink.net
- DNS ASK ze####mstudio.com
- DNS ASK su###hamali.com
- DNS ASK be###rcatch.com
- DNS ASK cr#######ibraryfoundation.org
- DNS ASK ev######arketinggroup.com
- DNS ASK im###ging.info
- DNS ASK ju####nd-reach.com
- DNS ASK ea###ain.com
- DNS ASK ca###ahpt.com
- DNS ASK sf##j.org
- DNS ASK cu###cores.com
- DNS ASK ka####serbia.org
- DNS ASK pi###jokes.org
- DNS ASK ma##m.com
- DNS ASK si#####rventures.com
- DNS ASK sk###nts.com
- DNS ASK ca###oc-bg.com
- DNS ASK ip##ddr.es
- DNS ASK my####rnalip.com
- DNS ASK cu###yip.com
- DNS ASK vo####irtuelle.com
- DNS ASK km##ich.com
- DNS ASK ii##avi.net
- DNS ASK re#####sprinter.info
- DNS ASK df###moilou.com
- DNS ASK he##.net
- DNS ASK gd###rit.com
