Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\Currentversion\Run] '{B5ACE834-10F2-F9E7-F54F-07C5A409E7FD}' = '%APPDATA%\Vibue\ikzyr.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\taskhost.exe
- <SYSTEM32>\rundll32.exe
- <SYSTEM32>\dwm.exe
- %WINDIR%\explorer.exe
the following user processes:
- iexplore.exe
- firefox.exe
- winmail.exe
Searches for registry branches where third party applications store passwords
- [HKLM\SOFTWARE\Wow6432Node\FlashFXP\3]
- [HKCU\SOFTWARE\Ghisler\Total Commander]
- [HKCU\SOFTWARE\Far\Plugins\ftp\hosts]
- [HKCU\SOFTWARE\Far2\Plugins\ftp\hosts]
- [HKCU\SOFTWARE\martin prikryl\winscp 2\sessions]
- [HKLM\SOFTWARE\Wow6432Node\martin prikryl\winscp 2\sessions]
- [HKCU\SOFTWARE\ftpware\coreftp\sites]
- [HKCU\Software\Microsoft\Windows Mail]
- [HKCU\Software\Microsoft\Windows Live Mail]
Modifies file system
Creates the following files
- %TEMP%\nsf8c0a.tmp\userinfo.dll
- %APPDATA%\over the atlantic - dimensions - we're all ghosts.mp3
- %TEMP%\nsf8c0a.tmp\manchet.dll
- %APPDATA%\vibue\ikzyr.exe
- %TEMP%\nske791.tmp\userinfo.dll
- %TEMP%\nske791.tmp\manchet.dll
- %TEMP%\tmpeed04901.bat
- %APPDATA%\kaqy\adik.tie
- %TEMP%\ppcrlui_3044_2
Deletes the following files
- %TEMP%\nsf8c0a.tmp\manchet.dll
- %TEMP%\nsf8c0a.tmp\userinfo.dll
- %TEMP%\nske791.tmp\manchet.dll
- %TEMP%\nske791.tmp\userinfo.dll
- %TEMP%\ppcrlui_3044_2
Moves the following files
- from %APPDATA%\kaqy\adik.tie to %APPDATA%\kaqy\adik.tmp
Deletes itself.
Network activity
Connects to
- 'pb##soc.com':80
- 'pb##soc.com':443
TCP
HTTP GET requests
- http://pb##soc.com/shipway/pbya.bin
Other
- 'pb##soc.com':443
UDP
- DNS ASK pb##soc.com
Miscellaneous
Searches for the following windows
- ClassName: 'OutlookExpressHiddenWindow' WindowName: ''
Creates and executes the following
- '%APPDATA%\vibue\ikzyr.exe'
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\tmpeed04901.bat"' (with hidden window)
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\tmpeed04901.bat"
- '%ProgramFiles%\windows mail\winmail.exe' -Embedding
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%APPDATA%\vibue\ikzyr.exe"
