Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'p2p_service' = '"%LOCALAPPDATA%\p2p\p2p_service.exe"'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name=\"p2p\" dir=in action=allow program=\"%LOCALAPPDATA%\p2p\p2p_service.exe\" enable=yes profile=public,private
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name=\"p2p\" dir=out action=allow program=\"%LOCALAPPDATA%\p2p\p2p_service.exe\" enable=yes profile=public,private
Modifies file system
Creates the following files
- %LOCALAPPDATA%\p2p\p2p_service.exe
- %LOCALAPPDATA%\kc quality consult ltd\p2p_service\org.peer2profit.p2pminimal.ini.lock
- %LOCALAPPDATA%\kc quality consult ltd\p2p_service\org.peer2profit.p2pminimal.ini.krxmoq
Deletes the following files
- %LOCALAPPDATA%\kc quality consult ltd\p2p_service\org.peer2profit.p2pminimal.ini.lock
Moves the following files
- from %LOCALAPPDATA%\kc quality consult ltd\p2p_service\org.peer2profit.p2pminimal.ini.krxmoq to %LOCALAPPDATA%\kc quality consult ltd\p2p_service\org.peer2profit.p2pminimal.ini
Network activity
Connects to
- 'ap#.##er2profit.com':443
- '19#.#3.50.138':443
- 'ch###.#eer2profit.site':443
- 'wi###edia.org':443
- 'gi##ub.com':443
- 'ub##tu.com':443
- 'tw##ter.com':443
- 'tw##ch.tv':443
- 'ap#.##ocklist.de':80
- 'ot#.##ienvault.com':443
- 'th###tcrowd.org':443
TCP
HTTP GET requests
- http://ap#.##ocklist.de/api.php?ip#######################
Other
- 'ap#.##er2profit.com':443
- '19#.#3.50.138':443
- 'ch###.#eer2profit.site':443
- 'wi###edia.org':443
- 'gi##ub.com':443
- 'tw##ch.tv':443
- 'ub##tu.com':443
- 'ot#.##ienvault.com':443
- 'th###tcrowd.org':443
UDP
- DNS ASK ap#.##er2profit.com
- DNS ASK 13#.##.#3.193.in-addr.arpa
- DNS ASK ch###.#eer2profit.site
- DNS ASK wi###edia.org
- DNS ASK gi##ub.com
- DNS ASK ub##tu.com
- DNS ASK tw##ter.com
- DNS ASK tw##ch.tv
- DNS ASK en.###ipedia.org
- DNS ASK ap#.##ocklist.de
- DNS ASK ot#.##ienvault.com
- DNS ASK th###tcrowd.org
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\p2p\p2p_service.exe'
- '%LOCALAPPDATA%\p2p\p2p_service.exe' -e pwsjBqRVuYnKLDFaf2/41JVRwrZfISrJrCEvlg5QoJbhVCJn48qCNcRddQKLdBTWecCUtu8PVrlwZXh3/59VDxIcXr4gtottED53/gEINKXGUvPmln851fU59S6tXi40czpf5Lwg7LK8RNjaR6RhoWUybIsq+deDxbS8quYoKHTjHaDA2JLrDZoL22Xw/u...
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c "netsh advfirewall firewall del rule name=\"p2p\""
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall del rule name=\"p2p\"
- '%WINDIR%\syswow64\cmd.exe' /c "netsh advfirewall firewall add rule name=\"p2p\" dir=in action=allow program=\"%LOCALAPPDATA%\p2p\p2p_service.exe\" enable=yes profile=public,private"
- '%WINDIR%\syswow64\cmd.exe' /c "netsh advfirewall firewall add rule name=\"p2p\" dir=out action=allow program=\"%LOCALAPPDATA%\p2p\p2p_service.exe\" enable=yes profile=public,private"
