Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'IrsEdixd' = '<LS_APPDATA>\albrsirm\irsedixd.exe'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,<LS_APPDATA>\albrsirm\irsedixd.exe'
Creates or modifies the following files
- %HOMEPATH%\start menu\programs\startup\irsedixd.exe
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
- Windows Security Center
blocks the following features:
- User Account Control (UAC)
- Windows Security Center
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\rnkjkuhg.exe
- %TEMP%\ytryipvb.exe
- %ALLUSERSPROFILE%\application data\psgfvbid.log
- <LS_APPDATA>\crxhxmec.log
- <LS_APPDATA>\albrsirm\irsedixd.exe
Sets the 'hidden' attribute to the following files
- %HOMEPATH%\start menu\programs\startup\irsedixd.exe
Network activity
UDP
- DNS ASK google.com
- DNS ASK ck###mqr.com
- DNS ASK pt#####mubhpvsrcqoi.com
- DNS ASK gc#####ilbvmudtaevx.com
- DNS ASK ya##o.com
- DNS ASK tj#####mupwqdnqvoc.com
- DNS ASK ef####eijxnp.com
- DNS ASK dh####fyggytq.com
- DNS ASK gg###yxl.com
- DNS ASK wh####hfvaepuv.com
- DNS ASK pn####wgakbfmul.com
- DNS ASK ql####vusokvwp.com
- DNS ASK vi###jgt.com
- DNS ASK ec###mvbito.com
- DNS ASK ym#####tgqsvjbejoki.com
- DNS ASK vj#####trtwslmejtgy.com
- DNS ASK uq####osvuns.com
- DNS ASK eb####xebrkc.com
- DNS ASK hs####kmmhuyy.com
- DNS ASK vj####rfwkfmab.com
- DNS ASK kh####ohulce.com
- DNS ASK go###qakn.com
- DNS ASK yt#####vvuepvlnnpmi.com
- DNS ASK vd###iwxfma.com
- DNS ASK hu####pybtqv.com
- DNS ASK ul###ypxq.com
- DNS ASK se###bjvff.com
- DNS ASK of###mjccjq.com
- DNS ASK uv###jrscv.com
- DNS ASK sn###qdcvh.com
- DNS ASK fh####cubiukxnv.com
- DNS ASK jy###yru.com
- DNS ASK qr####xkbyefjtk.com
- DNS ASK ih#####futpmafiwk.com
- DNS ASK sp####bqatvdb.com
- DNS ASK xx####vdcjcguxy.com
- DNS ASK ft#####sbfdnfevw.com
- DNS ASK hr###fhft.com
- DNS ASK qu#####npgohcxekl.com
- DNS ASK qb####crdulif.com
- DNS ASK bing.com
- DNS ASK xh###fooh.com
- DNS ASK ui#####gedxserarp.com
- DNS ASK yp#####mjoajpnktitd.com
- DNS ASK hb####uxhwwrgve.com
- DNS ASK nr###sqpswx.com
- DNS ASK ph#####bmibffdpoawh.com
- DNS ASK od#####ghpgljnonof.com
- DNS ASK xd#####hdgxltabayiu.com
- DNS ASK sm####kosslrtmu.com
- DNS ASK gi#####motbfoqbrxt.com
- DNS ASK ic###ashi.com
- DNS ASK es###vtphud.com
- DNS ASK do####dmnrnl.com
Miscellaneous
Creates and executes the following
- '%TEMP%\rnkjkuhg.exe'
Executes the following
- '<SYSTEM32>\svchost.exe'
