Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\software\microsoft\windows\currentversion\run] 'tibqanobatib' = '%HOMEPATH%\tibqanobatib.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Regedit32' = '<SYSTEM32>\regedit.exe'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\c5d8393293ce2ba62f117b2c2d55bc3e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %HOMEPATH%\tibqanobatib.exe
Sets the 'hidden' attribute to the following files
- %HOMEPATH%\tibqanobatib.exe
Network activity
Connects to
- 'je##o.co.uk':80
- 'va##r.se':80
- 'ly##.net':25
- 'du##ps.net':25
- 'cr###.edu.pl':80
- 'my##pcb.com':80
- 'fe##auer.de':80
- 'fi##bc.com':80
- 'vi###ndu.com':80
- 'pc##ate.com':80
- 'sc###er3.com':80
- 'cr##i.org':80
- 'ae##a.com':80
- 'sj##.org':80
- 'wa##i.pl':80
- 'pb###mes.com':80
- 'me##sa.info':80
- 'po###ood.com':80
- 'lr##k.com':80
- 'lu###emo.com':25
- 'at##uk.org':25
- 'mk##gr.com':80
- 'bt##.com.ph':25
- 're##iga.com':25
- 'ke##t.net':25
- 'bo###nst.com':80
- 're##iga.com':80
- 'nr##.com':80
- 'fc##vt.org':80
- 'li###l.co.jp':25
- 'rt##sey.com':25
- 'ha##ker.net':25
- 'av#e.hu':25
- 'mi##sh3.com':25
- 'hc##.org':25
- 'st##c.co.uk':80
- 'yo###sut.com':80
- 'ot##a.com':80
- 'ol##s.com':80
- 'de##lo.com':80
- 'ed##art.hu':80
- 'or##ito.com':80
- 'qu###ock.com':80
- 't-##e.com':80
- '2p##nt.com':80
- 'ko##.net':80
- 'st##um.com':80
- 'rs##g.com':80
- 'mo###nic.net':80
- 'el##o.si':80
- 'fn#.us':80
- 'ne##pak.nl':80
- 're##era.com':80
- 'dg##a.com':80
- 'sn##pak.com':80
- 'it##-pr.com':80
- 'al##or.cl':80
- 'co##sit.com':80
- 'ba##aku.com':80
- 'jc##sk.com':80
- 'pe##fan.com':80
- 'sp##esi.com':80
- 'xa##om.es':80
- 'tr###sib.com':80
- 'sp###hal.net':80
- 'hb##els.com':80
- 'k-##kko.com':80
- 'nu###ira.com':80
- 'ab##t.pl':80
- 'ho##eman.us':80
- 'fn##s.org':80
- 'tv##ols.fi':80
- 'ab##.com':80
- 'pw#.org':80
- 'hu##er.hu':80
- 'ar###nes.com':25
TCP
HTTP POST requests
- http://www.je##o.co.uk/
- http://www.fe##auer.de/
- http://www.ae##a.com/
- http://www.co###oko.com/
- http://www.ol##s.com/
- http://www.pe##fan.com/
- http://www.xa##om.es/
- http://www.fc##vt.org/
- http://www.tr###sib.com/
- http://www.hu##er.hu/
- http://www.nu###ira.com/
- http://www.de##lo.com/
- http://www.t-##e.com/
- http://www.or##ito.com/
- http://www.ne##pak.nl/
- http://www.st##um.com/
- http://www.fi##bc.com/
- http://www.st##c.co.uk/
UDP
- DNS ASK je##o.co.uk
- DNS ASK lr##k.com
- DNS ASK va##r.se
- DNS ASK mx#.mail.ru
- DNS ASK lu###emo.com
- DNS ASK am##e.com
- DNS ASK du##ps.net
- DNS ASK ly##.net
- DNS ASK li###l.co.jp
- DNS ASK cr###.edu.pl
- DNS ASK my##pcb.com
- DNS ASK fe##auer.de
- DNS ASK jr##.net
- DNS ASK fi##bc.com
- DNS ASK pc##ate.com
- DNS ASK vi###ndu.com
- DNS ASK cr##i.org
- DNS ASK sj##.org
- DNS ASK sc###er3.com
- DNS ASK ae##a.com
- DNS ASK wa##i.pl
- DNS ASK ft##at.com
- DNS ASK st##c.co.uk
- DNS ASK alt4.gmail-smtp-in.l.google.com
- DNS ASK th###sen.net
- DNS ASK at##uk.org
- DNS ASK aw#l.ws
- DNS ASK ar###nes.com
- DNS ASK bt##.com.ph
- DNS ASK ke##t.net
- DNS ASK in#.####.messagingengine.com
- DNS ASK mk##gr.com
- DNS ASK hb##els.com
- DNS ASK bo###nst.com
- DNS ASK sp###hal.net
- DNS ASK nr##.com
- DNS ASK k-##kko.com
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK rt##sey.com
- DNS ASK ha##ker.net
- DNS ASK av#e.hu
- DNS ASK an##ph.org
- DNS ASK mi##sh3.com
- DNS ASK hc##.org
- DNS ASK pb###mes.com
- DNS ASK po###ood.com
- DNS ASK me##sa.info
- DNS ASK sn##pak.com
- DNS ASK it##-pr.com
- DNS ASK de##lo.com
- DNS ASK ed##art.hu
- DNS ASK qu###ock.com
- DNS ASK 2p##nt.com
- DNS ASK or##ito.com
- DNS ASK t-##e.com
- DNS ASK ho##eman.us
- DNS ASK st##um.com
- DNS ASK ow##orts.ca
- DNS ASK rs##g.com
- DNS ASK mo###nic.net
- DNS ASK el##o.si
- DNS ASK ko##.net
- DNS ASK fn#.us
- DNS ASK re##era.com
- DNS ASK ne##pak.nl
- DNS ASK ty##s.com
- DNS ASK ba##aku.com
- DNS ASK dg##a.com
- DNS ASK fc##vt.org
- DNS ASK co###oko.com
- DNS ASK al##or.cl
- DNS ASK ot##a.com
- DNS ASK yo###sut.com
- DNS ASK ol##s.com
- DNS ASK co##sit.com
- DNS ASK jc##sk.com
- DNS ASK pe##fan.com
- DNS ASK sp##esi.com
- DNS ASK ve##om.com
- DNS ASK re##iga.com
- DNS ASK ne##.co.uk
- DNS ASK tr###sib.com
- DNS ASK hu##er.hu
- DNS ASK nu###ira.com
- DNS ASK ab##t.pl
- DNS ASK fn##s.org
- DNS ASK tv##ols.fi
- DNS ASK ab##.com
- DNS ASK pw#.org
- DNS ASK ud##ign.biz
- DNS ASK xa##om.es
- DNS ASK gb##g.com
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
