Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '14520' = '<Full path to file>'
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
Network activity
Connects to
- '24.#8.6.87':3128
- '19#.#01.165.72':3128
- '98.##8.146.0':3128
- '18#.#23.181.178':3128
- '20#.#50.203.252':3128
- '69.##3.237.95':3128
- '12#.#43.254.142':3128
- '19#.#4.167.175':3128
- '20#.#61.120.219':3128
- '88.##2.152.120':3128
- '11#.#2.138.168':3128
- '89.##5.187.36':3128
- '21#.#20.2.13':3128
- '20#.#34.214.51':3128
- '89.#1.224.4':3128
- '18#.24.8.57':3128
- '12#.#38.66.44':3128
- '68.##5.124.123':3128
- '22#.#25.210.185':3128
- '88.##9.230.18':3128
- '76.##9.59.198':3128
- '89.##.187.86':3128
- '22#.#46.251.32':3128
- '85.##9.253.227':3128
- '97.##.185.236':3128
- '67.##4.228.190':3128
- '99.##0.50.214':3128
- '21#.#7.128.4':3128
- '68.##.45.116':3128
- '12#.#64.236.190':3128
- '59.#.54.231':3128
- '92.##0.118.228':3128
- '19#.#05.99.197':3128
- '18#.#23.167.155':3128
- '59.#2.1.208':3128
- '89.##.139.112':3128
- '12#.#03.35.253':3128
- '68.##.114.30':3128
- '93.##3.11.83':3128
- '18#.#8.26.250':3128
- '18#.#9.78.238':3128
- '68.##.198.131':3128
- '12#.#50.0.61':3128
- '59.##.178.145':3128
- '12#.#3.47.240':3128
- '78.##.64.178':3128
- '20#.#07.180.72':3128
- '77.##8.200.25':3128
- '18#.#3.205.122':3128
- '72.##6.65.161':3128
- '60.#2.20.24':3128
- '64.##8.192.77':3128
- '12#.#38.42.53':3128
- '12#.#9.152.99':3128
- '75.##.146.10':3128
- '24.##2.68.36':3128
- '15#.#4.19.250':3128
- '83.#.54.190':3128
- '18#.#7.180.10':3128
- '99.##3.230.79':3128
- '77.##.14.144':3128
- '19#.#0.32.133':3128
- '89.#4.88.79':3128
- '71.##6.209.234':3128
- '18#.#0.215.243':3128
- '12#.#1.233.2':3128
- '19#.#20.124.26':3128
- '77.##.176.167':3128
- '17#.#0.133.101':3128
- '18#.1.3.65':3128
- '20#.#50.52.196':3128
- '12#.#44.250.77':3128
- '20#.#5.244.20':3128
- '89.#0.4.251':3128
- '20#.#.139.228':3128
- '20#.#04.148.92':3128
- '12#.#23.114.31':3128
- '18#.#7.18.211':3128
- '22#.#21.137.112':3128
- '68.##.139.244':3128
- '19#.#8.9.163':3128
- '20#.#59.216.103':3128
- '77.#7.1.106':3128
- '18#.#9.73.114':3128
- '68.##.236.201':3128
- '62.##2.144.192':3128
- '75.##9.230.124':3128
- '20#.#9.187.78':3128
- '95.##4.77.48':3128
- '85.##4.190.183':3128
- '21#.#8.69.77':3128
- '19#.#5.247.19':3128
- '79.##4.27.60':3128
- '19#.#09.102.106':3128
- '20#.#06.201.92':3128
- '18#.#3.186.168':3128
- '76.##2.13.246':3128
- '80.##.124.135':3128
- '20#.#73.11.235':3128
- '22#.#5.139.113':3128
- '90.##1.58.61':3128
- '77.#9.88.2':3128
- '18#.7.11.54':3128
- '20#.#18.199.93':3128
- '11#.#3.184.175':3128
- '22#.#39.163.216':3128
- '86.##6.14.42':3128
- '12#.#37.200.130':3128
- '93.##7.173.138':3128
- '20#.#5.222.246':3128
- '20#.#4.232.243':3128
- '19#.#64.87.136':3128
- '68.##.236.173':3128
- '60.##.188.190':3128
- '19#.#04.151.197':3128
- '18#.#8.179.75':3128
- '68.##6.88.185':3128
- '18#.#.147.221':3128
- '18#.#1.252.12':3128
- '20#.#7.218.31':3128
- '41.##1.122.28':3128
- '90.##1.52.170':3128
- '19#.#6.230.207':3128
- '18#.#.231.198':3128
- '20#.#0.221.80':3128
- '67.#2.3.13':3128
- '19#.#4.203.174':3128
- '20#.#71.167.35':3128
- '18#.#3.100.238':3128
- '19#.#05.22.85':3128
- '70.##6.124.152':3128
- '71.##8.96.240':3128
- '19#.#98.159.68':3128
- '17#.#06.124.64':3128
- '19#.#07.206.164':3128
- '69.##1.89.102':3128
- '74.##4.166.200':3128
- '58.##2.114.86':3128
- '20#.#0.77.236':3128
- '22#.#46.195.26':3128
- '18#.#03.194.17':3128
- '69.##1.194.200':3128
- '69.##3.126.92':3128
- '12#.#4.43.235':3128
- '89.##4.95.217':3128
- '20#.#.177.223':3128
- '81.##.120.194':3128
- '21#.#32.22.156':3128
- '12#.#36.250.118':3128
- '18#.#5.105.249':3128
- '17#.#06.11.235':3128
- '19#.#7.163.93':3128
- '20#.#6.9.162':3128
- '88.##8.33.218':3128
- '19#.#7.202.106':3128
- '80.#8.18.95':3128
- '21#.#38.126.169':3128
- '12#.#46.82.52':3128
- '62.##1.92.44':3128
- '20#.#12.100.168':3128
Miscellaneous
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
