Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'CryptoLocker' = '"%APPDATA%\Jmhskctribudntf.exe"'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\Jmhskctribudntf.exe' /w00000090
- '%APPDATA%\Jmhskctribudntf.exe' "/r<Full path to virus>"
Modifies file system :
Creates the following files:
- %TEMP%\BQBE5F8.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\home[1].htm
- %TEMP%\WTT73B5.tmp
- %TEMP%\KTP196.tmp
- %APPDATA%\Jmhskctribudntf.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\Jmhskctribudntf.exe
Deletes the following files:
- %TEMP%\BQBE5F8.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\home[1].htm
- %TEMP%\KTP196.tmp
- %TEMP%\WTT73B5.tmp
Deletes itself.
Network activity:
Connects to:
- 'si####gqucahnj.com':80
- 'fs####cvhbnnoe.info':80
- 'ot####jxmunbnr.biz':80
- 'be####fdytbhfd.net':80
- 'qd#####dtevenw.co.uk':80
- 'vn####dpqtapgy.biz':80
- 'vj####gxpfvbep.net':80
- 'dn####pigdjkfb.org':80
- 'wr####sysuujgw.ru':80
- 'fi####ytelobqi.biz':80
- 'kb####cyanlwfj.net':80
- 'hn####lhfjsese.org':80
- 'gm####fgrgyqqj.ru':80
- 'jw####vmmsbhoo.com':80
- 'qy####vlnsregl.org':80
- 'dj####rqarfkhn.ru':80
- 'iv####plyphtfi.info':80
- 'hr#####yluwefa.co.uk':80
- 'ga####ugrdikem.ru':80
- 'sk####hrpvgufk.biz':80
- 'hi#####hushsne.co.uk':80
- 'ts####tsslfdfo.org':80
- 'nf####wykjohtu.net':80
- 'kx#####sprbjty.co.uk':80
- 'ru####versgctp.org':80
- 'md####qmtfcvda.com':80
- 'la####rfgvnuth.info':80
- 'xw#####uxdiscm.co.uk':80
- 'xs####qdwoeesl.org':80
- 'uf####qonebhni.com':80
- 'yb####deaedmcr.info':80
- 'wo####btunjkcw.ru':80
- 'eq####kbktahek.com':80
- 'qb####wmimxrfp.info':80
- 'fy####wcnjypgd.biz':80
- 'rj####jnlcwaxu.net':80
UDP:
- DNS ASK be####fdytbhfd.net
- DNS ASK si####gqucahnj.com
- DNS ASK dj####rqarfkhn.ru
- DNS ASK ot####jxmunbnr.biz
- DNS ASK fs####cvhbnnoe.info
- DNS ASK wr####sysuujgw.ru
- DNS ASK vn####dpqtapgy.biz
- DNS ASK qd#####dtevenw.co.uk
- DNS ASK dn####pigdjkfb.org
- DNS ASK gm####fgrgyqqj.ru
- DNS ASK fi####ytelobqi.biz
- DNS ASK ir#####tsedtjr.co.uk
- DNS ASK hn####lhfjsese.org
- DNS ASK kb####cyanlwfj.net
- DNS ASK hr#####yluwefa.co.uk
- DNS ASK qy####vlnsregl.org
- DNS ASK jw####vmmsbhoo.com
- DNS ASK iv####plyphtfi.info
- DNS ASK vj####gxpfvbep.net
- DNS ASK ga####ugrdikem.ru
- DNS ASK sk####hrpvgufk.biz
- DNS ASK hi#####hushsne.co.uk
- DNS ASK ts####tsslfdfo.org
- DNS ASK nf####wykjohtu.net
- DNS ASK kx#####sprbjty.co.uk
- DNS ASK ru####versgctp.org
- DNS ASK md####qmtfcvda.com
- DNS ASK la####rfgvnuth.info
- DNS ASK xw#####uxdiscm.co.uk
- DNS ASK xs####qdwoeesl.org
- DNS ASK uf####qonebhni.com
- DNS ASK yb####deaedmcr.info
- DNS ASK wo####btunjkcw.ru
- DNS ASK eq####kbktahek.com
- DNS ASK qb####wmimxrfp.info
- DNS ASK fy####wcnjypgd.biz
- DNS ASK rj####jnlcwaxu.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: '(null)'
