Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'ctfmen' = '<SYSTEM32>\ctfmen.exe'
Modifies file system
Creates the following files
- %WINDIR%\syswow64\ctfmen.exe
- %WINDIR%\syswow64\shervans.dll
- %WINDIR%\syswow64\grcopy.dll
- %WINDIR%\syswow64\smnss.exe
- %WINDIR%\syswow64\satornas.dll
- %WINDIR%\syswow64\zipfi.dll
- %WINDIR%\syswow64\zipfiaq.dll
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\satornas.dll
Network activity
Connects to
- 'ph###ehmrn.in':80
- 'wn###ehqsn.in':80
- 'ea###msarn.ws':80
- 'eh###sepan.ws':80
- 'alt2.aspmx.l.google.com':25
- 'ma###.##vz.uni-linz.ac.at':25
- 'as####.googlemail.com':25
TCP
HTTP GET requests
- http://ph###ehmrn.in/imgs/krewa/nqxa.php?id#########################################
- http://wn###ehqsn.in/imgs/krewa/nqxa.php?id#########################################
- http://ea###msarn.ws/imgs/krewa/nqxa.php?id#########################################
- http://eh###sepan.ws/imgs/krewa/nqxa.php?id#########################################
Other
- 'ma###.##vz.uni-linz.ac.at':25
- 'alt2.aspmx.l.google.com':25
- 'aspmx.l.google.com':25
- 'as####.googlemail.com':25
UDP
- DNS ASK sh###hraen.biz
- DNS ASK at##i.com
- DNS ASK cd###.tvnet.hu
- DNS ASK qa###pwmha.info
- DNS ASK as####.googlemail.com
- DNS ASK aspmx.l.google.com
- DNS ASK ma###.##vz.uni-linz.ac.at
- DNS ASK jk.###-linz.ac.at
- DNS ASK alt2.aspmx.l.google.com
- DNS ASK me###nson.com
- DNS ASK eh###sepan.ws
- DNS ASK al####.caltech.edu
- DNS ASK gz##.org
- DNS ASK aa###rhnsr.com
- DNS ASK ea###msarn.ws
- DNS ASK np###mhasn.us
- DNS ASK hp###ashns.net
- DNS ASK ra###phawh.org
- DNS ASK sq###qhnah.biz
- DNS ASK as###smenh.com
- DNS ASK wn###ehqsn.in
- DNS ASK qs###hhaqh.info
- DNS ASK we###ahwws.in
- DNS ASK ph###ehmrn.in
- DNS ASK co###esan.com
- DNS ASK bi#####andholmes.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\ctfmen.exe'
- '%WINDIR%\syswow64\smnss.exe'
- '%WINDIR%\syswow64\ctfmen.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%WINDIR%\syswow64\smnss.exe"
