Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'pmshdkes' = '%APPDATA%\pmshdkes\fyomlice.vbs'
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\wscript.exe' "%APPDATA%\pmshdkes\mfvcjdqy.vbs"
Executes the following:
- '%ProgramFiles%\Windows Media Player\wmplayer.exe'
Injects code into
the following user processes:
- wmplayer.exe
Modifies file system:
Creates the following files:
- %APPDATA%\pmshdkes\fyomlice.vbs
- %APPDATA%\pmshdkes\xphtnnkj.exe
- %APPDATA%\pmshdkes\mfvcjdqy.vbs
- %ALLUSERSPROFILE%\Application Data\kdgihdcp.log
- <LS_APPDATA>\wcxnjluo.log
Deletes itself.
Network activity:
Connects to:
- 'sh###cshjjy.eu':8001
- 'ni####vkfjwotm.bid':8001
- 'db#####prntqertmkty.bid':8001
- 'ef######qrnwgichmf.click':8001
- 'go#####nsompympnook.bid':8001
- 'on####vgpnqdo.click':8001
- 'jk######tmrfqjpfjv.click':8001
- 'dq#####uksyynnrsk.eu':8001
- 'mm###moxph.eu':8001
- 'ct###mkgdgo.eu':8001
- 'gy#####kapwhtefyilb.bid':8001
- 'gv#####oyuiuvcbdicp.bid':8001
- 'oa#####fcfknttwg.click':8001
- 'pm####rvnwyjaxq.bid':8001
- 'xd#####ydgnnaj.click':8001
- 'yl####exyhtm.click':8001
- 'cp#####mwtatekrlljq.eu':8001
- 'gs####opwdtnn.click':8001
- 'ok####ypvelhqreb.eu':8001
- 'fj####dnwcpfolu.eu':8001
- 'tx###dwtvm.bid':8001
- 'pa###ootb.eu':8001
- '12#.#25.114.144':80
- 'jv####homdkphp.bid':8001
- 'rr#####fwboqltnre.click':8001
- 'eb###qab.click':8001
- 'uu######coeyueknxs.click':8001
- 'ak#####efytnvaitwav.eu':8001
- 'jj###cdhnojx.eu':8001
- 'yq####sjsoet.bid':8001
- 'ok##orxw.eu':8001
- 'bf####pbwltyhe.bid':8001
- 'jb####sgtjqlor.bid':8001
- 'ra###sywa.click':8001
UDP:
- DNS ASK sh###cshjjy.eu
- DNS ASK ni####vkfjwotm.bid
- DNS ASK db#####prntqertmkty.bid
- DNS ASK ef######qrnwgichmf.click
- DNS ASK go#####nsompympnook.bid
- DNS ASK on####vgpnqdo.click
- DNS ASK jk######tmrfqjpfjv.click
- DNS ASK dq#####uksyynnrsk.eu
- DNS ASK mm###moxph.eu
- DNS ASK ct###mkgdgo.eu
- DNS ASK gy#####kapwhtefyilb.bid
- DNS ASK gv#####oyuiuvcbdicp.bid
- DNS ASK oa#####fcfknttwg.click
- DNS ASK pm####rvnwyjaxq.bid
- DNS ASK xd#####ydgnnaj.click
- DNS ASK yl####exyhtm.click
- DNS ASK cp#####mwtatekrlljq.eu
- DNS ASK gs####opwdtnn.click
- DNS ASK ok####ypvelhqreb.eu
- DNS ASK fj####dnwcpfolu.eu
- DNS ASK tx###dwtvm.bid
- DNS ASK pa###ootb.eu
- DNS ASK ba##u.com
- DNS ASK jv####homdkphp.bid
- DNS ASK rr#####fwboqltnre.click
- DNS ASK eb###qab.click
- DNS ASK uu######coeyueknxs.click
- DNS ASK ak#####efytnvaitwav.eu
- DNS ASK jj###cdhnojx.eu
- DNS ASK yq####sjsoet.bid
- DNS ASK ok##orxw.eu
- DNS ASK bf####pbwltyhe.bid
- DNS ASK jb####sgtjqlor.bid
- DNS ASK ra###sywa.click
