Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\WinDivert1.1] 'ImagePath' = '%TEMP%\3jm3tucf9v\WinDivert64.sys'
Creates the following services
- 'WinDivert1.1' %TEMP%\3jm3tucf9v\WinDivert64.sys
Modifies file system
Creates the following files
- C:\usr\local\etc\kmgkvdb\8ea1d8a86c03064c2b431bd1a66893a7
- %TEMP%\b4j5eawpb8.txt
- %APPDATA%\kmg\fh97xm8zmf\c987266b12640d4b45d638ced6dde110
- %APPDATA%\cpt55z3yv2\data.wefsp3rzte9j9ztd7w6s7dek
- %TEMP%\3jm3tucf9v\windivert32.dll
- %TEMP%\3jm3tucf9v\windivert64.sys
- %WINDIR%\temp\udd8813.tmp
Deletes the following files
- %WINDIR%\temp\udd8813.tmp
Moves the following files
- from %APPDATA%\cpt55z3yv2\data.wefsp3rzte9j9ztd7w6s7dek to %APPDATA%\cpt55z3yv2\data
Network activity
TCP
HTTP POST requests
- http://13#.###.50.202:20005/ClientApi
UDP
- DNS ASK rt#######wins.crossinstall.com
- DNS ASK ge####book-lk.com
- DNS ASK sa###api.com
- DNS ASK mo###i-help.com
- DNS ASK ui####e-time.com
- DNS ASK ne###s-cdn.com
- DNS ASK e-###lad.com
- DNS ASK ca###a.co.za
- DNS ASK wi######ia-help-links.com
- DNS ASK a7###.akam.net
- DNS ASK ge####web-link2.com
- DNS ASK ge####ee-plk.com
- DNS ASK ge#####-hindu-link.com
- DNS ASK 8v##.com
- DNS ASK ge####x-links.com
- DNS ASK nu###cnnc5.com
- DNS ASK st#######ice.crossinstall.io
- DNS ASK im#.###ssinstall.com
- DNS ASK ss######ts.chartboost.com
- DNS ASK vi#.xvpn.io
- DNS ASK ge###csoft.com
- DNS ASK d2#######0box5.cloudfront.net
- DNS ASK a2###.akam.net
- DNS ASK ns###.awsdns-11.com
- DNS ASK a1###.b.akamai.net
- DNS ASK in####.#ungle.akadns.net
- DNS ASK ns#####.awsdns-44.co.uk
- DNS ASK ap#.###gle.akadns.net
- DNS ASK cd#.###8g4g2.hwcdn.net
- DNS ASK cd#.###7a3j9.hwcdn.net
- DNS ASK c4############n-env.us-east-1.elasticbeanstalk.com
- DNS ASK v2.###rtboost.com
- DNS ASK hi####ad-api.com
- DNS ASK ad#####y.wpengine.com
- DNS ASK ss#####.##ccdn.net.c.footprint.net
- DNS ASK dn##.#09.nsone.net
- DNS ASK wd.##colony.xyz
- DNS ASK d2#######q0x2u.cloudfront.net
- DNS ASK i.#######r.net.edgesuite.net
- DNS ASK dn##.#05.nsone.net
- DNS ASK a1##.akam.net
- DNS ASK a2###7.akam.net
- DNS ASK ns##.#djust.works
- DNS ASK a2.###rtboost.com
- DNS ASK ap#.#ungle.com
- DNS ASK ap#.#djust.com
- DNS ASK ap####asurement.com
- DNS ASK mo########tic.adsafeprotected.com
- DNS ASK ad####protected.com
- DNS ASK g9###emrzy.com
- DNS ASK tp#.####lesyndication.com
- DNS ASK de########visioning.googleapis.com
- DNS ASK go#######4.g.doubleclick.net
- DNS ASK tr###.appsflyer.com
- DNS ASK go######s.g.doubleclick.net
- DNS ASK pa#####.#ooglesyndication.com
- DNS ASK pa#####.#oogleadservices.com
- DNS ASK go#####dservices.com
- DNS ASK adservice.google.com
- DNS ASK c4##.#dcolony.com
- DNS ASK wd.##colony.com
- DNS ASK ev#####alt.adcolony.com
- DNS ASK ev#####.adcolony.com
- DNS ASK ad.###bleclick.net
- DNS ASK st###mrail.com
- DNS ASK li##.#hartboost.com
- DNS ASK ad#.##i.vungle.com
- DNS ASK px.###.linkedin.com
- DNS ASK an######ds23.adcolony.com
- DNS ASK ad###ony.com
- DNS ASK c4#####.adcolony.com
- DNS ASK ze###h-api.com
- DNS ASK ns2.google.com
- DNS ASK ad######nch.adcolony.com
- DNS ASK ad###.adcolony.com
- DNS ASK da.###rtboost.com
- DNS ASK tr###.atom-data.io
- DNS ASK pi##########ng.sonic-us.supersonicads.com
- DNS ASK cl#######roxy.supersonicads.com
- DNS ASK is#######y.supersonicads.com
- DNS ASK in##.##personicads.com
- DNS ASK lo##.#upersonic.com
- DNS ASK i.###gular.net
- DNS ASK ds#.##i.vungle.com
- DNS ASK in####.vungle.com
- DNS ASK tr###.tenjin.io
- DNS ASK ns#####.awsdns-32.co.uk
Miscellaneous
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 2 "<Full path to file>"
