Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d9' = '%APPDATA%\1e6f17d9.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d' = 'C:\1e6f17d9\1e6f17d9.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\1e6f17d9.exe
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
Executes the following:
- '<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet
- '<SYSTEM32>\svchost.exe' netsvcs
- '%WINDIR%\explorer.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system :
Creates the following files:
- %APPDATA%\1e6f17d9.exe
- C:\1e6f17d9\1e6f17d9.exe
Network activity:
Connects to:
- 'xo##n.com':80
- 'bh####kaonline.com':80
- 'bu###esscod.com':80
- 'af####nadvances.com':80
- 'ar##ella.kz':80
- 'fo####imagenes.com':80
- 'bi####digital.com':80
- 'bl####yzworld.com':80
- 'th.###lander.com':80
- '10####r100unity.com':80
- 'da#.#vc.uab.es':80
- 'bl##.##op4men.com.br':80
- 'ho###ance.ru':80
- 'be#####roseville.org':80
- 'ga##cbv.com':80
- 'ka###ewelry.com':80
- 'ka##an.ru':80
- 'bi####acelets.ro':80
- 'no###aron.com':80
- 'le##ptic.ro':80
- 'be#####eoyunlari.org':80
- 'mi####lserwa.com':80
- 'cs#.###ebangalore.org':80
- 'an###erie.de':80
- 'be#####ebetterwe.com':80
- 'br######emaneslabardena.com':80
- 'eh####urgical.com':80
- 'ae####oftball.com':80
- 'my####rnalip.com':80
- 'ip##ddr.es':80
- 'cu###yip.com':80
- 'be##el.vn':80
- 'ib##a.com':80
- 'gu###ones.com':80
- 'hu####nbahadi.com':80
- 'ha##ebo.de':80
- 'bo#####rvisi.info.tr':80
- 'da####cement.com':80
- 'ro####apartman.hu':80
- 'ez####veloper.com':80
- 'bl##.ogc.com.pk':80
- '3d####orymexico.com':80
- 'ho###uk.info':80
- 'fu#####homesearch.com':80
TCP:
HTTP GET requests:
- http://cu###yip.com/
- http://my####rnalip.com/raw
- http://ip##ddr.es/
HTTP POST requests:
- http://bu###esscod.com/tmp/e.php?f=#############
- http://xo##n.com/wp-content/themes/twentythirteen/e.php?p=#############
- http://ar##ella.kz/wp-content/plugins/wp-db-backup-made/a.php?g=#############
- http://no###aron.com/wp-content/plugins/contact-form-7/includes/js/jquery-ui/themes/smoothness/images/a.php?a=#############
- http://af####nadvances.com/wp-content/plugins/updraftplus/oc/guzzle/Guzzle/Service/Command/LocationVisitor/Request/a.php?e=#############
- http://da#.#vc.uab.es/wordpress/wp-content/plugins/wp-db-backup-made1/d.php?s=#############
- http://th.###lander.com/wp-content/plugins/wp-db-backup-made/b.php?q=#############
- http://10####r100unity.com/wp-includes/js/tinymce/skins/wordpress/images/e.php?q=#############
- http://bh####kaonline.com/plugins/system/plg_system_rewrite/a.php?k=#############
- http://fo####imagenes.com/wp-content/plugins/wp-mobile-edition/admin/includes/mobile_themes/mTheme-Unus/images/blue/a.php?b=#############
- http://bl##.##op4men.com.br/wp-content/plugins/wp-antibot-standart/a.php?p=#############
- http://ho###ance.ru/wp-content/themes/dreamynight-10/a.php?v=#############
- http://be#####roseville.org/wp-content/plugins/wp-antibot-standart/c.php?b=#############
- http://ga##cbv.com/plugins/system/plg_system_rewrite/a.php?n=#############
- http://ka###ewelry.com/il/wp-content/plugins/ninja-forms/includes/admin/pages/ninja-forms-settings/tabs/c.php?q=#############
- http://le##ptic.ro/wp-content/themes/twentytwelve/c.php?n=#############
- http://bi####acelets.ro/wp-content/themes/twentytwelve/e.php?r=#############
- http://mi####lserwa.com/wp-content/plugins/wp-db-backup-made/a.php?q=#############
- http://ka##an.ru/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/nextgen_gallery_display/templates/list/a.php?x=#############
- http://be#####eoyunlari.org/wp-content/themes/twentytwelve/b.php?t=#############
- http://bi####digital.com/wp-content/themes/twentytwelve/c.php?l=#############
- http://eh####urgical.com/plugins/system/plg_system_rewrite/b.php?j=#############
- http://be#####ebetterwe.com/wp-content/plugins/wp-antibot-standart/d.php?k=#############
- http://br######emaneslabardena.com/plugins/system/plg_system_rewrite/c.php?n=#############
- http://ez####veloper.com/tmp/b.php?r=#############
- http://bl##.ogc.com.pk/wp-content/plugins/wp-antibot-standart/e.php?r=#############
- http://be##el.vn/wp-content/themes/twentytwelve/b.php?x=#############
- http://ib##a.com/blog/wp-content/plugins/scribe/lib/history/views/meta-box/c.php?k=#############
- http://ae####oftball.com/wp-content/themes/sports-team-theme/includes/advanced-custom-fields/assets/inc/datepicker/images/c.php?r=#############
- http://cs#.###ebangalore.org/wp-content/themes/twentyeleven/d.php?e=#############
- http://an###erie.de/wp-content/plugins/revslider/css/jui/new/images/d.php?m=#############
- http://ha##ebo.de/plugins/system/plg_system_rewrite/a.php?l=#############
- http://gu###ones.com/wp-content/themes/twentyeleven/a.php?z=#############
- http://da####cement.com/blog/wp-content/plugins/wp-antibot-standart3/b.php?d=#############
- http://bl####yzworld.com/wp-content/plugins/wp-antibot-standart/d.php?x=#############
- http://bo#####rvisi.info.tr/wp-content/themes/twentytwelve/d.php?q=#############
- http://fu#####homesearch.com/wp-content/plugins/wp-antibot-standart/b.php?p=#############
- http://3d####orymexico.com/foro/vendor/symfony/http-foundation/Symfony/Component/HttpFoundation/Session/Storage/Handler/c.php?q=#############
- http://ho###uk.info/wp-content/uploads/e.php?x=#############
- http://hu####nbahadi.com/wp-content/uploads/b.php?p=#############
- http://ro####apartman.hu/de/wp-content/plugins/wp-db-backup-made/e.php?u=#############
UDP:
- DNS ASK xo##n.com
- DNS ASK bh####kaonline.com
- DNS ASK bu###esscod.com
- DNS ASK af####nadvances.com
- DNS ASK ar##ella.kz
- DNS ASK fo####imagenes.com
- DNS ASK bi####digital.com
- DNS ASK bl####yzworld.com
- DNS ASK th.###lander.com
- DNS ASK 10####r100unity.com
- DNS ASK da#.#vc.uab.es
- DNS ASK bl##.##op4men.com.br
- DNS ASK ho###ance.ru
- DNS ASK be#####roseville.org
- DNS ASK ga##cbv.com
- DNS ASK ka###ewelry.com
- DNS ASK ka##an.ru
- DNS ASK bi####acelets.ro
- DNS ASK no###aron.com
- DNS ASK le##ptic.ro
- DNS ASK be#####eoyunlari.org
- DNS ASK mi####lserwa.com
- DNS ASK cs#.###ebangalore.org
- DNS ASK an###erie.de
- DNS ASK be#####ebetterwe.com
- DNS ASK br######emaneslabardena.com
- DNS ASK eh####urgical.com
- DNS ASK ae####oftball.com
- DNS ASK my####rnalip.com
- DNS ASK ip##ddr.es
- DNS ASK cu###yip.com
- DNS ASK be##el.vn
- DNS ASK ib##a.com
- DNS ASK gu###ones.com
- DNS ASK hu####nbahadi.com
- DNS ASK ha##ebo.de
- DNS ASK bo#####rvisi.info.tr
- DNS ASK da####cement.com
- DNS ASK ro####apartman.hu
- DNS ASK ez####veloper.com
- DNS ASK bl##.ogc.com.pk
- DNS ASK 3d####orymexico.com
- DNS ASK ho###uk.info
- DNS ASK fu#####homesearch.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
