Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '212683d986fb740ad6a40184df48e604' = '"%TEMP%\server.exe" ..'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '212683d986fb740ad6a40184df48e604' = '"%TEMP%\server.exe" ..'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\server.exe' = '%TEMP%\server.exe:*:Enabled:server.exe'
Executes the following:
- '%TEMP%\server.exe'
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\server.exe" "server.exe" ENABLE
- '%TEMP%\_av_iup.tm~a02920\instup.exe' /edition:12 /ga_clientid:b0943a25-ac3c-42ad-bebb-bda7253322eb /guid:daa49d8d-001b-43b4-ac63-a2175d4e6cdc /prod:ais /sfx:lite /sfxstorage:%TEMP%\_av_iup.tm~a02920
- '%TEMP%\nigga.exe'
- '%TEMP%\Setup FR.exe'
Modifies file system:
Creates the following files:
- %TEMP%\server.exe
- %ALLUSERSPROFILE%\Application Data\AVAST Software\Avast\avast5.ini
- %ALLUSERSPROFILE%\Application Data\AVAST Software\Persistent Data\Avast\Logs\event_manager.log
- %TEMP%\nigga.exe
- %TEMP%\Setup FR.exe
- %ALLUSERSPROFILE%\Application Data\AVAST Software\Persistent Data\Avast\Logs\Setup.log
Deletes the following files:
- %TEMP%\_av_iup.tm~a02920\prod-pgm.vpx.dld
- %TEMP%\_av_iup.tm~a02920\servers.def.vpx.dld
Network activity:
Connects to:
- 'j2######.iavs9x.u.avast.com':80
- 'j8######.iavs9x.u.avast.com':80
- 'w0######.iavs9x.u.avast.com':80
- 'r4######.iavs9x.u.avast.com':80
- 'd0######.iavs9x.u.avast.com':80
- 'n9######.iavs9x.u.avast.com':80
- 'ss#.####le-analytics.com':443
- 'l5######.iavs9x.u.avast.com':80
- 'p7######.iavs9x.u.avast.com':80
- 'x2######.iavs9x.u.avast.com':80
- 'au##.#f.avast.com':443
- 'localhost':1177
- 'www.go#####analytics.com':80
- 'v7#####.stats.avast.com':80
- 'c3######.iavs9x.u.avast.com':80
- 's6######.iavs9x.u.avast.com':80
- 'f5######.iavs9x.u.avast.com':80
- 'k2######.iavs9x.u.avast.com':80
- 'h9######.iavs9x.u.avast.com':80
TCP:
HTTP GET requests:
- http://j8######.iavs9x.u.avast.com/iavs9x/prod-pgm.vpx
- http://d0######.iavs9x.u.avast.com/iavs9x/prod-pgm.vpx
- http://j2######.iavs9x.u.avast.com/iavs9x/servers.def.vpx
- http://j2######.iavs9x.u.avast.com/iavs9x/prod-pgm.vpx
- http://s6######.iavs9x.u.avast.com/iavs9x/prod-pgm.vpx
- http://p7######.iavs9x.u.avast.com/iavs9x/prod-pgm.vpx
- http://n9######.iavs9x.u.avast.com/iavs9x/prod-pgm.vpx
- http://f5######.iavs9x.u.avast.com/iavs9x/prod-pgm.vpx
- http://l5######.iavs9x.u.avast.com/iavs9x/prod-pgm.vpx
- http://k2######.iavs9x.u.avast.com/iavs9x/servers.def.vpx
- http://h9######.iavs9x.u.avast.com/iavs9x/servers.def.vpx
- http://www.go#####analytics.com/collect?an#############################################################################################################################################
- http://c3######.iavs9x.u.avast.com/iavs9x/servers.def.vpx
- http://s6######.iavs9x.u.avast.com/iavs9x/servers.def.vpx
- http://w0######.iavs9x.u.avast.com/iavs9x/servers.def.vpx
- http://r4######.iavs9x.u.avast.com/iavs9x/servers.def.vpx
- http://f5######.iavs9x.u.avast.com/iavs9x/servers.def.vpx
- http://x2######.iavs9x.u.avast.com/iavs9x/servers.def.vpx
HTTP POST requests:
- http://v7#####.stats.avast.com/cgi-bin/iavsevents.cgi
UDP:
- DNS ASK j2######.iavs9x.u.avast.com
- DNS ASK j8######.iavs9x.u.avast.com
- DNS ASK w0######.iavs9x.u.avast.com
- DNS ASK r4######.iavs9x.u.avast.com
- DNS ASK d0######.iavs9x.u.avast.com
- DNS ASK n9######.iavs9x.u.avast.com
- DNS ASK ss#.####le-analytics.com
- DNS ASK l5######.iavs9x.u.avast.com
- DNS ASK p7######.iavs9x.u.avast.com
- DNS ASK x2######.iavs9x.u.avast.com
- DNS ASK sh#####d.ff.avast.com
- DNS ASK au##.#f.avast.com
- DNS ASK www.go#####analytics.com
- DNS ASK v7#####.stats.avast.com
- DNS ASK c3######.iavs9x.u.avast.com
- DNS ASK s6######.iavs9x.u.avast.com
- DNS ASK f5######.iavs9x.u.avast.com
- DNS ASK k2######.iavs9x.u.avast.com
- DNS ASK h9######.iavs9x.u.avast.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
