Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'e999c8b1' = 'mshta javascript:gFJamvi6H="CY";W97m=new%20ActiveXObject("WScript.Shell");am7uoQM4r="fDhd";sgB0l=W97m.RegRead("H...
- [<HKLM>\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'd659a622' = 'mshta javascript:Gx1GbUT="f";r5g2=new%20ActiveXObject("WScript.Shell");tV6iUwHQ="aAbQw";d24riY...
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'e999c8b1' = 'mshta javascript:T8I4KxbC="zFj";mt8=new%20ActiveXObject("WScript.Shell");rlUSY1p="OAEsqmX";u4nhR=mt8.RegRead("HKCU\\software...
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\explorer.exe
the following user processes:
- iexplore.exe
Hooks functions
in browsers
- iexplore.exe process, advapi32.dll module
- firefox.exe process, advapi32.dll module
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1206' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2300' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1809' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1206' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2300' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1809' = '00000003'
Modifies file system
Deletes itself.
Network activity
Connects to
- '19#.#08.112.208':80
- '15#.#44.25.60':80
- '12#.#3.68.78':80
- '10#.#52.70.116':80
- '66.##5.82.128':80
- '22.##0.29.143':80
- '11#.#46.18.91':80
- '90.##6.66.118':80
- '25#.#0.61.79':80
- '14#.#87.158.254':80
- '83.##.140.77':8080
- '6.##.35.158':80
- '28.##1.115.100':80
- '14#.#07.194.141':80
- '83.##4.205.11':80
- '74.#.177.173':80
- '19#.#73.50.26':80
- '73.#.148.182':80
- '9.##.142.244':80
- '14#.27.9.44':80
- '22#.#46.239.5':80
- '11#.#34.11.24':443
- '22#.#7.115.109':80
- '21.##2.127.230':8080
- '24#.#4.143.43':80
- '17#.#5.80.196':80
- '10#.9.75.76':80
- '18#.#34.122.207':80
- '99.##5.78.169':80
- '28.##8.65.210':80
- '35.##.215.231':80
- '54.##2.164.78':80
- '12#.#14.49.14':80
- '52.##2.106.159':80
- '20#.#56.78.46':80
- '19#.#8.186.250':80
- '70.##9.204.216':80
- '15#.#31.193.152':8080
- '66.##9.4.148':80
- '71.#.1.173':80
- '11#.#6.94.18':80
- '15#.#99.116.91':80
- '12#.#26.88.194':80
- '23#.#46.197.232':80
- '94.##.203.20':80
- '75.##9.107.102':80
- '78.##4.92.168':80
- '18#.#72.126.125':80
- '23#.#5.128.6':80
- '18#.#5.17.17':80
- '7.##.34.208':443
- '70.##.25.220':8080
- '7.###.141.78':80
- '21#.#47.248.41':80
- '19#.#9.87.214':80
- '55.##2.194.116':80
- '96.##1.255.52':80
- '18#.#28.22.173':80
- '12#.#53.182.121':80
- '23#.#34.219.152':80
- '16.##6.76.240':80
- '12#.#81.91.21':80
- '25#.#0.58.34':8080
- '11#.#44.179.144':80
- '40.##.204.224':80
- '25#.#0.123.227':80
- '19#.#6.187.1':80
- '20#.#62.98.140':80
- '38.##1.213.80':80
- '21#.#5.30.76':80
- '13#.#48.194.146':80
- '19#.#35.121.137':80
- '94.##0.155.169':80
- '41.##9.247.76':80
- '11#.#5.93.14':80
- '42.##8.3.135':80
- '24#.#55.161.99':80
- '23#.#46.35.95':80
- 're#####elligence.com':80
- '12#.#41.205.157':443
- '25#.#66.217.36':443
- '20#.#60.221.235':80
- '23#.#49.85.25':80
- '32.##.68.151':80
- '49.##.215.175':80
- '19#.#68.11.59':80
- '12#.#26.188.219':80
- '10#.#96.40.149':80
- '17#.#4.175.195':80
- '15#.#42.42.32':80
- '19#.#18.40.161':80
- '16#.#98.219.48':443
- '13#.#79.206.148':80
- '76.#9.89.31':80
- '11#.#4.45.150':443
- '10.##.51.215':80
- '12#.#12.29.68':443
- '20#.#88.126.206':443
- '22#.#90.75.229':80
- '19.##6.128.1':443
- '23#.#42.76.236':8080
- '96.##.128.167':80
- '31.##6.248.16':80
- '21#.10.7.69':80
- '14#.#89.56.96':80
- '18#.#36.106.160':80
- '24#.#87.86.249':80
- '19.##4.126.130':80
- '38.##.57.213':80
- '18#.#75.134.167':80
- '15#.#8.197.45':80
- '63.##.110.64':80
- '81.##6.151.90':80
- '20#.#21.64.48':80
- '38.##2.38.144':80
- '24#.#0.50.128':80
- '12#.#9.91.95':80
- '39.##.143.98':80
- '83.#0.39.25':80
- '16.##.183.159':80
- '23#.#1.68.214':80
- '24#.#3.176.186':80
- '23#.#81.193.178':80
- '12#.#38.80.10':80
- '17#.#94.19.174':80
- '17#.#6.122.127':80
- '68.##9.248.161':80
- '17#.#6.99.159':80
- '25.##.30.208':8080
- 're#####elligence.com':443
- '11#.#8.62.128':443
- '35.##2.221.186':80
- '22#.#74.90.180':80
- '99.#6.76.96':80
- '3.###.121.115':80
- '23#.#54.128.73':80
- '30.##4.228.237':80
- '24#.#2.61.251':8080
- '20.##5.36.209':80
- '12.#.157.141':80
- '15#.#9.36.88':80
- '77.##.174.198':8080
- '24#.#79.118.137':80
- '75.##8.195.132':80
- '88.##8.144.201':80
- '31.##2.219.249':80
- '13#.#52.122.178':80
- '18.##.13.131':80
- '14#.#6.167.110':80
- '23#.#34.7.161':80
- '48.##4.116.120':443
- '38.#2.59.13':80
- '23#.#06.136.229':80
- '16#.#8.244.141':80
- '24#.#00.238.184':80
TCP
HTTP POST requests
- http://18.##1.61.78/
Other
- 're#####elligence.com':80
- 're#####elligence.com':443
UDP
- DNS ASK re#####elligence.com
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\explorer.exe'
