Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Regedit32' = '<SYSTEM32>\regedit.exe'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Network activity
Connects to
- '255.255.255.255':25
UDP
- DNS ASK ba##ari.com
- DNS ASK ru##e.com
- DNS ASK tc##a.com
- DNS ASK aw###ser.com
- DNS ASK ad###tist.ro
- DNS ASK ad##sa.net
- DNS ASK en##gen.com
- DNS ASK s5#.com
- DNS ASK gc##.com
- DNS ASK pr##fa.com
- DNS ASK cn##.krsn.ru
- DNS ASK ka##man.net
- DNS ASK uh##.edu.ag
- DNS ASK ne###inx.org
- DNS ASK ie##oi.com
- DNS ASK pc##.net
- DNS ASK ai###s-sa.gr
- DNS ASK do##jog.net
- DNS ASK fo##in.net
- DNS ASK ma###.##gitalwaves.co.nz
- DNS ASK xs##.com
- DNS ASK fr##at.com
- DNS ASK ab###ast.com
- DNS ASK ka##am.com
- DNS ASK cl##ma.com
- DNS ASK fr###0ty.com
- DNS ASK hb##els.com
- DNS ASK mj##pas.com
- DNS ASK cu###own.com
- DNS ASK to##hfam.ca
- DNS ASK in#.####.messagingengine.com
- DNS ASK 4l##als.net
- DNS ASK se##k.com
- DNS ASK rt##sey.com
- DNS ASK an##ph.org
- DNS ASK e-##mi.net
- DNS ASK ha##att.com
- DNS ASK zu##eil.com
- DNS ASK ca##sil.com
- DNS ASK ar###nes.com
- DNS ASK pe###s.co.uk
- DNS ASK ju##-gr.ch
- DNS ASK ke###ail.com
- DNS ASK as###eum.com
- DNS ASK kt##ergo.ru
- DNS ASK am##-tc.si
- DNS ASK de###viny.cz
- DNS ASK es##ke.net
- DNS ASK he#.pt
- DNS ASK aw#l.ws
- DNS ASK ho#t.do
- DNS ASK sk#m.ru
- DNS ASK th###sen.net
- DNS ASK pa##ski.org
- DNS ASK at##hun.com
- DNS ASK zu##aha.cz
- DNS ASK 89###pel.com
- DNS ASK vo###ris.com
- DNS ASK cp##eam.com
- DNS ASK x9#.com
- DNS ASK gy##ozo.ru
- DNS ASK ka##la.fr
- DNS ASK gb##jp.com
- DNS ASK sa##v.ro
- DNS ASK we##ays.com
- DNS ASK ul##bax.org
- DNS ASK ze###mot.net
- DNS ASK ms###ock.com
- DNS ASK re##oar.com
- DNS ASK mi###ana.org
- DNS ASK ao##ko.net
- DNS ASK vf###dia.com
- DNS ASK ft###ile.com
- DNS ASK cb##s.com
- DNS ASK lu##a.cz
- DNS ASK we##and.com
- DNS ASK st##llc.com
- DNS ASK or###gas.com
- DNS ASK do###bag.org
- DNS ASK ht##x.net
- DNS ASK an###ork.com
- DNS ASK sm##.#irectcon.net
- DNS ASK wi##sub.com
- DNS ASK fo##knox.bm
- DNS ASK mi##nue.com
- DNS ASK am##e.com
- DNS ASK rk##gg.com
- DNS ASK in##tech.pl
- DNS ASK ak#.co.id
- DNS ASK ne##le.pl
- DNS ASK at##uk.org
- DNS ASK n2###ina.com
- DNS ASK av#.com.sa
- DNS ASK nl##.bas.bg
- DNS ASK ra##ich.de
- DNS ASK pc###ncu.com
- DNS ASK sk###arl.com
- DNS ASK so###zer.com
- DNS ASK mc###rope.nl
- DNS ASK ku##den.com
- DNS ASK mk##gr.com
- DNS ASK ca###nly.com
- DNS ASK th##ark.org
- DNS ASK on##da.com
- DNS ASK ok###imo.com
- DNS ASK cj###ent.com
- DNS ASK 78##n.com
- DNS ASK sh###ble.com
- DNS ASK bi##oll.com
- DNS ASK ac##in.com
- DNS ASK pi##ton.com
- DNS ASK sa###tek.net
- DNS ASK ro##er.de
- DNS ASK al##inox.es
- DNS ASK sl###port.ru
- DNS ASK ku##avto.ru
- DNS ASK no##esse.be
- DNS ASK nc#.de
- DNS ASK so##wan.net
- DNS ASK cv##l.org
- DNS ASK oa##h.ca
- DNS ASK am###for.com
- DNS ASK ir##ytu.net
- DNS ASK an##s.net
- DNS ASK sh##m.ru
- DNS ASK we###ant.com
- DNS ASK bo##do.com
- DNS ASK ca###fix.com
- DNS ASK ka###.com.pl
- DNS ASK ja##an.com
- DNS ASK sm##ko.net
- DNS ASK po##ook.com
- DNS ASK cp##b.com
- DNS ASK mx#.mail.ru
- DNS ASK ko##e.com
- DNS ASK gp###dit.org
- DNS ASK mi##p.com
- DNS ASK ar##x.com
- DNS ASK ss#.ch
- DNS ASK lp##r.com
- DNS ASK ri##.org
- DNS ASK ab#.org.eg
- DNS ASK cq###oup.com
- DNS ASK ke###web.com
- DNS ASK am#c.at
- DNS ASK nm#.co.jp
- DNS ASK bo###.com.tw
- DNS ASK sl##er.it
- DNS ASK ku###ara.com
- DNS ASK po###ccd.org
- DNS ASK gu##rat.com
- DNS ASK nr##.com
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK nb##wis.com
- DNS ASK fd##mca.org
- DNS ASK js##s.com
- DNS ASK us##ig.com
- DNS ASK ma##ek.com
- DNS ASK cu##hie.com
- DNS ASK ne##.co.uk
- DNS ASK ro##ron.com
- DNS ASK ne##no.net
- DNS ASK um##r.am
- DNS ASK so###kan.com
- DNS ASK e-##set.net
- DNS ASK ik##ani.com
- DNS ASK li##c.co.uk
- DNS ASK bd###yle.com
- DNS ASK to##hin.com
- DNS ASK fl##pis.com
- DNS ASK bo###nst.com
- DNS ASK ke##t.net
- DNS ASK ra#t.se
- DNS ASK alt4.gmail-smtp-in.l.google.com
- DNS ASK bg##.com
- DNS ASK mi##sh3.com
- DNS ASK ch##o.ru
- DNS ASK ca##ore.com
- DNS ASK in##ctus.pl
- DNS ASK li###gds.com
- DNS ASK bi###hera.pl
- DNS ASK mu##ip.hu
- DNS ASK as##.org.au
- DNS ASK pe##ex.com
- DNS ASK va###lit.com
- DNS ASK da###nir.com
- DNS ASK da##o.com
- DNS ASK ic###ost.com
- DNS ASK wa##a.com
- DNS ASK cc##i.org
- DNS ASK ta##les.net
- DNS ASK bt##.com.ph
- DNS ASK tb##ugus.nl
- DNS ASK ka##el.com
- DNS ASK pe##net.net
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
