Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%PROGRAMDATA%\UBlockPlugin\plugin.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'zelunifoqikadu.exe' = '<SYSTEM32>\zelunifoqikadu.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\zelunifoqikadu.exe
Creates the following files on removable media
- <Drive name for removable media>:\winmine.exe.id-cf6f02e4.[krastoken@gmail.com].roger
- <Drive name for removable media>:\default.bmp.id-cf6f02e4.[krastoken@gmail.com].roger
- <Drive name for removable media>:\dialmap.bmp.id-cf6f02e4.[krastoken@gmail.com].roger
- <Drive name for removable media>:\dashborder_192.bmp.id-cf6f02e4.[krastoken@gmail.com].roger
- <Drive name for removable media>:\tileimage.bmp.id-cf6f02e4.[krastoken@gmail.com].roger
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Injects code into
the following system processes:
- %WINDIR%\syswow64\secinit.exe
Modifies file system
Creates the following files
- %PROGRAMDATA%\ublockplugin\plugin.exe
- C:\far2\pluginsdk\headers.c\farkeys.hpp.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\pluginsdk\headers.c\plugin.hpp.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\addons\colors\custom_highlighting\colors_from_sadovoj.reg.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\addons\colors\custom_highlighting\black_from_july.reg.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\addons\colors\custom_highlighting\descript.ion.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\addons\colors\custom_highlighting\farcolors242.reg.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\addons\colors\custom_highlighting\import_colors.bat.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\addons\colors\custom_highlighting\dn_like.reg.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\addons\colors\custom_highlighting\hell.reg.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\addons\colors\custom_highlighting\nc5pal2.reg.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\addons\colors\custom_highlighting\rodion_doroshkevich.reg.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\addons\colors\custom_highlighting\greenmile.reg.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\pluginsdk\headers.c\farcolor.hpp.id-cf6f02e4.[krastoken@gmail.com].roger
- D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg.id-cf6f02e4.[krastoken@gmail.com].roger
- <SYSTEM32>\zelunifoqikadu.exe
- %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\zelunifoqikadu.exe
- C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\addons\readme.txt.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\documentation\eng\arc_support.txt.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\documentation\eng\plugins_install.txt.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\documentation\eng\plugins_review.txt.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\documentation\eng\bug_report.txt.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\documentation\eng\techinfo.txt.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\documentation\rus\arc_support.txt.id-cf6f02e4.[krastoken@gmail.com].roger
- %PROGRAMDATA%\ublockplugin\zelunifoqikadu.exe
- C:\far2\documentation\rus\bug_report.txt.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\documentation\rus\plugins_review.txt.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\documentation\rus\techinfo.txt.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\documentation\rus\far_faq.txt.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\encyclopedia\farencyclopedia_ru.chm.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\encyclopedia\tap\code.bin.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\plugins\ftp\ftpcmds.txt.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\plugins\ftp\ftpcmds_rus.txt.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\plugins\ftp\notes.txt.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\plugins\ftp\notes_rus.txt.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\documentation\eng\far_faq.txt.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\documentation\rus\plugins_install.txt.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\far2\addons\colors\custom_highlighting\vaxcolors.reg.id-cf6f02e4.[krastoken@gmail.com].roger
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml.id-cf6f02e4.[krastoken@gmail.com].roger
Sets the 'hidden' attribute to the following files
- C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini.id-cf6f02e4.[krastoken@gmail.com].roger
- D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini.id-cf6f02e4.[krastoken@gmail.com].roger
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://ap####er11113.info/api/update/ZTM0MDdhMThjODIyOGJiYjgzMDNmZjAwNzMzMDZhZjk5Nzc3Y2QzYTQ0OTlkYmRjOWEzNDQ2YTIyNTMxNGU0MDNkNDBhOGQxNGVlZTg3NGRiZjQ5M2NiZjk1Y2IyZThkZjA0NTU0ODFkNTFmOGU0YzA2Mzky...
- http://ap####er11113.info/Account/Login?Re#######################
- http://45.##8.157.17/api/update/ZTM0MDdhMThjODIyOGJiYjgzMDNmZjAwNzMzMDZhZjk5Nzc3Y2QzYTQ0OTlkYmRjOWEzNDQ2YTIyNTMxNGU0MDNkNDBhOGQxNGVlZTg3NGRiZjQ5M2NiZjk1Y2IyZThkZjA0NTU0ODFkNTFmOGU0YzA2MzkyYWJlZ...
- http://ap####er11113.info/api/download/ZTM0MDdhMThjODIyOGJiYjgzMDNmZjAwNzMzMDZhZjk5Nzc3Y2QzYTQ0OTlkYmRjOWEzNDQ2YTIyNTMxNGU0MDNkNDBhOGQxNGVlZTg3NGRiZjQ5M2NiZjk1Y2IyZThkZjA0NTU0ODFkNTFmOGU0YzA2Mz...
UDP
- DNS ASK ap####er11113.info
Miscellaneous
Creates and executes the following
- '%PROGRAMDATA%\ublockplugin\plugin.exe' "<Full path to file>" ensgJJ
- '%PROGRAMDATA%\ublockplugin\zelunifoqikadu.exe'
- '%PROGRAMDATA%\ublockplugin\plugin.exe' "<Full path to file>" ensgJJ' (with hidden window)
- '%PROGRAMDATA%\ublockplugin\zelunifoqikadu.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\secinit.exe'
- '<SYSTEM32>\cmd.exe'
- '<SYSTEM32>\mode.com' con cp select=1251
