Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'F1WCufV2gHgqzF3oCVbdJA==' = '"%APPDATA%\Mozilla\Firefox\Profiles\sfc.exe"'
Malicious functions:
Injects code into
the following system processes:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\cscript.exe
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\ctfmon.exe
a large number of user processes.
Terminates or attempts to terminate
the following user processes:
- safari.exe
- opera.exe
- chrome.exe
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000003'
Modifies file system:
Creates the following files:
- %APPDATA%\Mozilla\Firefox\Profiles\sfc.exe
Deletes itself.
Network activity:
Connects to:
- 'oj###o1.gmz.cc':443
- 'em#####oc0wqt.umc.su':443
- 'i6######1vlqclinp.umc.su':443
- '15#####cjwximsws.jeo.cc':443
- 'mt#####9zye34r.gmz.cc':443
- '2d####q1cri.jeo.cc':443
- 'ys######zxs3loo00.jeo.cc':443
- 'ga####t5z.umc.su':443
- 'qf###4o.gmz.cc':443
- 'zz#####e5rd50rg.umc.su':443
- 't0#####uzqujj8z5.umc.su':443
- '6s######jxrcbp44g.jeo.cc':443
- 'x0###f.umc.su':443
- 'nb#####951kcz4g.jeo.cc':443
- 'bg###mhq.umc.su':443
- 'gd####6muf1.umc.su':443
UDP:
- DNS ASK 15#####cjwximsws.jeo.cc
- DNS ASK oj###o1.gmz.cc
- DNS ASK em#####oc0wqt.umc.su
- DNS ASK 5g###0.gmz.cc
- DNS ASK zs#####00z6ass.gmz.cc
- DNS ASK i6######1vlqclinp.umc.su
- DNS ASK ys######zxs3loo00.jeo.cc
- DNS ASK 2d####q1cri.jeo.cc
- DNS ASK gr#####thy3wwu2.jeo.cc
- DNS ASK sa#####9m1ehn4sh.jeo.cc
- DNS ASK v5####tg0ydg.umc.su
- DNS ASK ga####t5z.umc.su
- DNS ASK mt#####9zye34r.gmz.cc
- DNS ASK zz#####e5rd50rg.umc.su
- DNS ASK bg###mhq.umc.su
- DNS ASK gd####6muf1.umc.su
- DNS ASK t0#####uzqujj8z5.umc.su
- DNS ASK 6s######jxrcbp44g.jeo.cc
- DNS ASK qf###4o.gmz.cc
- DNS ASK x0###f.umc.su
- DNS ASK rb######gi27mtm5n.jeo.cc
- DNS ASK rb###f.gmz.cc
- DNS ASK ld####m0j.gmz.cc
- DNS ASK nb#####951kcz4g.jeo.cc
- DNS ASK 7b###m.jeo.cc
- DNS ASK nn######jamvfp0t7.jeo.cc
