Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'mabtednecymn' = '%HOMEPATH%\mabtednecymn.exe'
Modifies file system:
Creates the following files:
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %APPDATA%\Microsoft\Protect\CREDHIST
- %HOMEPATH%\mabtednecymn.exe
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\mabtednecymn.exe
Network activity:
Connects to:
- 'sm##.live.com':25
UDP:
- DNS ASK hz###hai.com
- DNS ASK fr##el.com
- DNS ASK pe####p-pinky.com
- DNS ASK fi####ousepr.com
- DNS ASK bo####nder4u.com
- DNS ASK ra##as.com
- DNS ASK te##age.cz
- DNS ASK so###ack.com
- DNS ASK fj#####rkfestivalen.com
- DNS ASK at#####isu-6fdental.com
- DNS ASK br#####olmarketing.com
- DNS ASK na###olar.com
- DNS ASK ma######.midwestlabs.com
- DNS ASK le##cy.com
- DNS ASK ka####awa-news.org
- DNS ASK fl##hf.com
- DNS ASK ed###ost.com
- DNS ASK ne###entral.com
- DNS ASK sm##.#ompuserve.com
- DNS ASK ro####farlane.com
- DNS ASK sa##ons.com
- DNS ASK fu#####okconsulting.com
- DNS ASK wi###p-pt.com
- DNS ASK kw###puters.com
- DNS ASK sy#######ic-technologies.com
- DNS ASK m-##in.ru
- DNS ASK da##ho.info
- DNS ASK as###-gomu.com
- DNS ASK he###-holz.at
- DNS ASK hs###iguel.com
- DNS ASK bu######entrum-engelshof.de
- DNS ASK 10###old.com
- DNS ASK mi###ral.com.au
- DNS ASK kg###heslaw.com
- DNS ASK ke####-tengoku.com
- DNS ASK wn##.org
- DNS ASK in#######undhandelsverlag.de
- DNS ASK lo#####einteriors.com
- DNS ASK ci####indhorn.org
- DNS ASK bo###oil.com
- DNS ASK pa###ship.com
- DNS ASK al##as.org
- DNS ASK ma#####rretora.com.br
- DNS ASK hi###e-aa.com
- DNS ASK y3###ans.com
- DNS ASK mm###ytek.cz
- DNS ASK su####golfhomes.com
- DNS ASK ca###oloaks.com
- DNS ASK al####riginals.com
- DNS ASK pi###ecassi.com
- DNS ASK we##.co.jp
- DNS ASK al######canprintinginc.com
- DNS ASK cc####ited.org.uk
- DNS ASK fh##.com
- DNS ASK bu####gton.co.uk
- DNS ASK di###onic.es
- DNS ASK wo####fesupport.com
- DNS ASK ba###h-biz.com
- DNS ASK as##d.com
- DNS ASK ho###tinc.com
- DNS ASK ch#####efesta.com.br
- DNS ASK ka##oft.cz
- DNS ASK 89###pel.com
- DNS ASK re###k.co.uk
- DNS ASK bc##ex.com
- DNS ASK gs###nters.com
- DNS ASK dh###tate.com
- DNS ASK vc##z.org
- DNS ASK ra##inc.com
- DNS ASK bl###voib.com
- DNS ASK dt.#om.pl
- DNS ASK st#####gfoundations.com
- DNS ASK wh###pbell.com
- DNS ASK mi##a.com
- DNS ASK ba####ehotel.com
- DNS ASK sm##.#irectcon.net
- DNS ASK na####ziowiec.com
- DNS ASK id##p.com
- DNS ASK so#o.nl
- DNS ASK in##mex.com
- DNS ASK sm##.live.com
- DNS ASK sm##.#ail.yahoo.com
- DNS ASK sm##.###global.yahoo.com
- DNS ASK ac###escorp.com
- DNS ASK og##ust.jp
- DNS ASK dr###sis.org
- DNS ASK se###-porn.com
- DNS ASK in###-lock.com
- DNS ASK so###dev.com
- DNS ASK se####uspeha.com
- DNS ASK gg#.ch
- DNS ASK rc##nc.biz
- DNS ASK ur##it.com
- DNS ASK be###aire.org
- DNS ASK uh##.edu.ag
- DNS ASK ma##.#irmail.net
- DNS ASK po####wisconsin.com
- DNS ASK la####manzana.es
- DNS ASK th#####ntingcenter.org
- DNS ASK ma####-shirasu.com
- DNS ASK he####provider.com
- DNS ASK ma###etimes.com
- DNS ASK yo##mfg.com
- DNS ASK no##zel.net
- DNS ASK de#####arborrealty.com
- DNS ASK qu###esis.com
- DNS ASK co###abass.org
- DNS ASK im###alaton.com
- DNS ASK da###ecno.cl
- DNS ASK su##.edu
- DNS ASK go###are.com
- DNS ASK ho####oyfull.com
- DNS ASK ma####shaven.com
- DNS ASK to###horei.com
- DNS ASK in#####atepartners.com
- DNS ASK am#######ourguesthouse.co.uk
- DNS ASK mo####stfriend.com
- DNS ASK er##z.org
- DNS ASK la#####mhorserugs.com
- DNS ASK bc##aw.com
- DNS ASK st####schambers.com
