Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\software\microsoft\windows\currentversion\run] 'tibqanobatib' = '%HOMEPATH%\tibqanobatib.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Regedit32' = '<SYSTEM32>\regedit.exe'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\c5d8393293ce2ba62f117b2c2d55bc3e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %HOMEPATH%\tibqanobatib.exe
Sets the 'hidden' attribute to the following files
- %HOMEPATH%\tibqanobatib.exe
Network activity
Connects to
- 'nb##wis.com':80
- 'vd###rty.com':80
TCP
HTTP POST requests
- http://www.je##o.co.uk/
- http://www.fc##vt.org/
- http://www.ex###ive.com/
- http://www.ae##a.com/
- http://www.yo###sut.com/
- http://www.pc##ate.com/
- http://www.t-##e.com/
- http://www.na##-a.com/
- http://www.fi##bc.com/
- http://www.ba##aku.com/
- http://www.ot##spm.com/
- http://www.lr##k.com/
- http://www.sp###hal.net/
- http://www.ka###-me.com/
- http://www.po###ood.com/
- http://www.cr##i.org/
- http://www.h-#.net/
- http://www.ja##mfg.com/
- http://www.pd###mes.com/
- http://ms###ock.com/
- http://ic###ost.com/
- http://fo##in.net/
- http://mi##p.com/
- http://www.jc##sk.com/
- http://al###ope.biz/
- http://sh##er.com/
- http://in##ctus.pl/
- http://cb##en.com/
- http://si###ann.com/
- http://oa##h.ca/
- http://ja##an.com/
- http://ad###tist.ro/
- http://www.sj##.org/
- http://www.qu###ock.com/
- http://www.st##c.co.uk/
- http://www.el##o.si/
- http://www.rs##g.com/
- http://www.mo###nic.net/
- http://www.fn#.us/
- http://www.2p##nt.com/
- http://www.or##ito.com/
- http://www.de##lo.com/
- http://www.st##um.com/
- http://www.ty##s.com/
- http://www.ho##eman.us/
- http://www.al##or.cl/
- http://www.sn##pak.com/
- http://www.tr###sib.com/
- http://www.ab##.com/
- http://www.ne##pak.nl/
- http://www.dg##a.com/
- http://www.pe##fan.com/
- http://www.ed##art.hu/
- http://www.fn##s.org/
- http://www.pw#.org/
- http://www.co##sit.com/
- http://www.ab##t.pl/
- http://www.tv##ols.fi/
- http://mi##han.com/
- http://www.hu##er.hu/
- http://ft###ile.com/
- http://www.nu###ira.com/
- http://www.ot##a.com/
- http://www.cr###.edu.pl/
- http://www.co###oko.com/
- http://www.pb###mes.com/
- http://www.xa##om.es/
- http://ap##tex.com/
UDP
- DNS ASK re##era.com
- DNS ASK si###ann.com
- DNS ASK ra#t.se
- DNS ASK cj###ent.com
- DNS ASK ma##ek.com
- DNS ASK sh##er.com
- DNS ASK mi##han.com
- DNS ASK am##-tc.si
- DNS ASK cb##en.com
- DNS ASK oa##h.ca
- DNS ASK mi##p.com
- DNS ASK ja##an.com
- DNS ASK mx#.mail.ru
- DNS ASK al###ope.biz
- DNS ASK sl##er.it
- DNS ASK ad###tist.ro
- DNS ASK re##oar.com
- DNS ASK ja##mfg.com
- DNS ASK ne##no.net
- DNS ASK wv##net.de
- DNS ASK si##tar.com
- DNS ASK gb##jp.com
- DNS ASK ik##ani.com
- DNS ASK vo###ris.com
- DNS ASK ha###-me.com
- DNS ASK ne###inx.org
- DNS ASK ka###.com.pl
- DNS ASK or###gas.com
- DNS ASK be##in.com
- DNS ASK nt#.edu.au
- DNS ASK n2###ina.com
- DNS ASK in##ctus.pl
- DNS ASK pd###mes.com
- DNS ASK nb##wis.com
- DNS ASK bo###.com.tw
- DNS ASK lu###emo.com
- DNS ASK ep#.com.au
- DNS ASK fo##in.net
- DNS ASK mi###ana.org
- DNS ASK tc##a.com
- DNS ASK rt##sey.com
- DNS ASK h-##-l.com
- DNS ASK tb##ugus.nl
- DNS ASK ms###ock.com
- DNS ASK ft###ile.com
- DNS ASK ic###ost.com
- DNS ASK alt4.gmail-smtp-in.l.google.com
- DNS ASK cl##ma.com
- DNS ASK jo###yon.org
- DNS ASK ac##loc.com
- DNS ASK ma###.##gitalwaves.co.nz
- DNS ASK vi###tay.com
- DNS ASK k-##kko.com
- DNS ASK li###l.co.jp
- DNS ASK dz#.cz
- DNS ASK mc###rope.nl
- DNS ASK c-##op.net
- DNS ASK pl##ke.ua
- DNS ASK wi##sub.com
- DNS ASK in#.####.messagingengine.com
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK ap##tex.com
- DNS ASK sl###port.ru
- DNS ASK pe##.com
- DNS ASK ca##mat.com
- DNS ASK co##sit.com
- DNS ASK it##-pr.com
- DNS ASK ud##ign.biz
- DNS ASK fn##s.org
- DNS ASK dg##a.com
- DNS ASK ed##art.hu
- DNS ASK jc##sk.com
- DNS ASK pw#.org
- DNS ASK tr###sib.com
- DNS ASK sn##pak.com
- DNS ASK ab##.com
- DNS ASK al##or.cl
- DNS ASK tv##ols.fi
- DNS ASK ty##s.com
- DNS ASK ho##eman.us
- DNS ASK 2p##nt.com
- DNS ASK de##lo.com
- DNS ASK or##ito.com
- DNS ASK st##um.com
- DNS ASK ow##orts.ca
- DNS ASK rs##g.com
- DNS ASK mo###nic.net
- DNS ASK el##o.si
- DNS ASK ko##.net
- DNS ASK fn#.us
- DNS ASK ne##pak.nl
- DNS ASK je##o.co.uk
- DNS ASK qu###ock.com
- DNS ASK hu##er.hu
- DNS ASK ab##t.pl
- DNS ASK cr###.edu.pl
- DNS ASK h-#.net
- DNS ASK jr##.net
- DNS ASK us##ig.com
- DNS ASK ka###-me.com
- DNS ASK sp###hal.net
- DNS ASK gp##ink.com
- DNS ASK lr##k.com
- DNS ASK ot##spm.com
- DNS ASK ba##aku.com
- DNS ASK fi##bc.com
- DNS ASK ra###ook.net
- DNS ASK t-##e.com
- DNS ASK na##-a.com
- DNS ASK yo###sut.com
- DNS ASK pc##ate.com
- DNS ASK ae##a.com
- DNS ASK nu###ira.com
- DNS ASK fc##vt.org
- DNS ASK cr##i.org
- DNS ASK vi###ndu.com
- DNS ASK po###ood.com
- DNS ASK ex###ive.com
- DNS ASK sj##.org
- DNS ASK st##c.co.uk
- DNS ASK pe##fan.com
- DNS ASK pb###mes.com
- DNS ASK co###oko.com
- DNS ASK ot##a.com
- DNS ASK ve##om.com
- DNS ASK xa##om.es
- DNS ASK vd###rty.com
- DNS ASK bi##z.by
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
