Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '<SYSTEM32>\ctfmon.exe'
- [HKCU\Software\Classes\.exe] '' = 'exefile'
- [HKCU\Software\Classes\.exe] 'Content Type' = 'application/x-msdownload'
- [HKCU\Software\Classes\.exe\shell\open\command] '' = '"%LOCALAPPDATA%\vki.exe" -a "%1" %*'
- [HKCU\Software\Classes\exefile\shell\open\command] '' = '"%LOCALAPPDATA%\vki.exe" -a "%1" %*'
- [HKLM\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command] '' = '"%LOCALAPPDATA%\vki.exe" -a "%ProgramFiles(x86)%\Mozilla Firefox\firefox.exe"'
- [HKLM\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command] '' = '"%LOCALAPPDATA%\vki.exe" -a "%ProgramFiles(x86)%\Internet Explorer\iexplore.exe"'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Security Center
- Windows Defender
blocks the following features:
- Windows Action Center
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
the following user processes:
- iexplore.exe
- firefox.exe
Modifies file system
Creates the following files
- %LOCALAPPDATA%\vki.exe
- %LOCALAPPDATA%\2465wgyj5qdfq8ohx83vxlmuc1j81e6ce0vhcl27
- %ALLUSERSPROFILE%\2465wgyj5qdfq8ohx83vxlmuc1j81e6ce0vhcl27
- %TEMP%\2465wgyj5qdfq8ohx83vxlmuc1j81e6ce0vhcl27
- %APPDATA%\microsoft\windows\templates\2465wgyj5qdfq8ohx83vxlmuc1j81e6ce0vhcl27
Deletes itself.
Network activity
Connects to
- 'microsoft.com':80
UDP
- DNS ASK we###inymu.com
- DNS ASK xe###ywas.com
- DNS ASK ju###uqag.com
- DNS ASK re####vobosila.com
- DNS ASK wi####hobovy.com
- DNS ASK microsoft.com
- DNS ASK no####baxufok.com
- DNS ASK py####xododaj.com
- DNS ASK qa###yhan.com
- DNS ASK ve####kazujago.com
- DNS ASK wu####zosuka.com
- DNS ASK fu####nytyfa.com
- DNS ASK ji###adyf.com
- DNS ASK po###ipix.com
- DNS ASK bo###ipim.com
- DNS ASK xy####viwamela.com
- DNS ASK su###umezez.com
- DNS ASK pa####hewypas.com
- DNS ASK co####xuvyhiti.com
- DNS ASK by###ysugot.com
- DNS ASK pe####haturap.com
- DNS ASK vo###okipy.com
- DNS ASK qo###owyfiv.com
- DNS ASK jo###ufeb.com
- DNS ASK ki####cidorek.com
- DNS ASK ly####qokivo.com
- DNS ASK ro####xyzabihy.com
- DNS ASK qu####nocowi.com
- DNS ASK ro###epym.com
- DNS ASK ba####sagisoq.com
- DNS ASK ba###obof.com
- DNS ASK cu####wawezy.com
- DNS ASK nu####palefete.com
- DNS ASK gu####geqaze.com
- DNS ASK ku####duwuvoc.com
- DNS ASK ru###ahec.com
- DNS ASK ku####bujohaq.com
- DNS ASK qi###ugugu.com
- DNS ASK do###oboji.com
- DNS ASK ku###iqaje.com
- DNS ASK fo###yguwow.com
- DNS ASK li####jaroquw.com
- DNS ASK mo###ijeb.com
- DNS ASK gu###ivadu.com
- DNS ASK cu####wydiwy.com
- DNS ASK my####xyrofizo.com
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
- ClassName: 'msascui_class' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'Media Center Tray Applet' WindowName: ''
- ClassName: '' WindowName: 'View Available Networks'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''
Creates and executes the following
- '%LOCALAPPDATA%\vki.exe' -gav <Full path to file>
Executes the following
- '%WINDIR%\explorer.exe'
