Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'CSRSS' = '"%ALLUSERSPROFILE%\Drivers\csrss.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent c95470da86e76ced
- %WINDIR%\tasks\explorgu.job
Modifies master boot record (MBR).
Malicious functions
Injects code into
the following user processes:
- c0b3.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %APPDATA%\tbuittv
- %ALLUSERSPROFILE%\drivers\csrss.exe
- %TEMP%\is-qsbv8.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-qsbv8.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-qsbv8.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-qsbv8.tmp\_isetup\_setup64.tmp
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_d99ef00b-ccd3-4f1d-9980-90ac453b0b47
- %TEMP%\is-6ip9q.tmp\1471.tmp
- %TEMP%\1471.exe
- %TEMP%\1f9.exe
- %TEMP%\cfb2.exe
- %TEMP%\c0b3.exe
- %TEMP%\b00f.exe
- %TEMP%\936a.exe
- %TEMP%\8112.dll
- %TEMP%\7290.exe
- %TEMP%\00c07260dc\explorgu.exe
- %TEMP%\4kpv6a~1\state.tmp
Sets the 'hidden' attribute to the following files
- %APPDATA%\tbuittv
- %ALLUSERSPROFILE%\drivers\csrss.exe
Deletes the following files
- %TEMP%\8112.dll
Moves the following files
- from %TEMP%\4kpv6a~1\state.tmp to %TEMP%\4kpv6a~1\state
Deletes itself.
Network activity
Connects to
- 'se####ation17io.io':80
- '18#.#15.113.45':80
- 'tr##c.com':80
- '18#.#72.128.19':80
- 'ni###.bestsup.su':80
- 'localhost':49191
- '14#.#4.27.137':9001
- '16#.#72.68.222':9001
TCP
HTTP GET requests
- http://18#.#15.113.45/mine/amert.exe
- http://tr##c.com/check/index.php
- http://18#.#72.128.19/288c47bbc1871b439df19ff4df68f07776.exe
- http://ni###.bestsup.su/data/pdf/may.exe
HTTP POST requests
- http://se####ation17io.io/index.php
UDP
- DNS ASK se####ation17io.io
- DNS ASK tr##c.com
- DNS ASK ni###.bestsup.su
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
- ClassName: 'zd0a59_Flash342FixClass_zd0a59' WindowName: ''
Creates and executes the following
- '%TEMP%\7290.exe'
- '%TEMP%\936a.exe'
- '%TEMP%\b00f.exe'
- '%TEMP%\c0b3.exe'
- '%TEMP%\cfb2.exe'
- '%TEMP%\1f9.exe'
- '%TEMP%\1471.exe'
- '%TEMP%\is-6ip9q.tmp\1471.tmp' /SL5="$2800A6,1649107,56832,%TEMP%\1471.exe"
Executes the following
- '<SYSTEM32>\regsvr32.exe' /s %TEMP%\8112.dll
