Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
Malicious functions:
Creates and executes the following:
- '%TEMP%\IXP000.TMP\ОЮЅз99~1.EXE'
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG' WindowName: '(null)'
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = '127.0.0.1:9666'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '127.0.0.1'
- [<HKLM>\SYSTEM\ControlSet001\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1C00' = '{00,00,00,00}'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'CurrentLevel' = '{00,00,00,00}'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
Modifies file system :
Creates the following files:
- %TEMP%\~fcqdcsiytih0v4l
- %TEMP%\~dxfjiyjbuji9y6g
- %TEMP%\IXP000.TMP\ОЮЅз99~1.EXE
- %TEMP%\IXP000.TMP\WJupdate.exe
Network activity:
Connects to:
- '21#.#57.28.135':443
- '16#.#89.61.247':443
- '71.#.81.81':443
- '20#.#05.75.196':443
- '65.#9.14.13':443
- '22#.#31.70.186':443
- '67.##0.210.243':443
- '65.#9.14.11':443
- '65.#9.2.17':443
- '22#.#36.15.105':443
- '65.#9.2.26':443
- '65.#9.2.21':443
- '63.##5.209.31':443
- '20#.#6.181.191':443
- '21#.#5.4.130':443
- '11#.#05.88.54':443
- '11#.#2.88.245':443
- '65.#9.2.18':443
- '12#.#.229.183':443
- '11#.#05.112.111':443
- '63.##5.209.10':443
- '13#.#41.3.154':443
- '24.#.17.25':443
- '65.##2.34.104':443
- '20#.#6.104.198':443
- '16#.#66.73.14':443
- '24.##0.232.147':443
- '80.##.114.72':443
- '21#.#40.245.12':443
- '21#.#71.54.214':443
- '19#.#28.29.9':443
- '67.#64.5.52':443
- '99.##1.208.243':443
- '19#.#39.146.19':443
- '13#.#91.143.18':443
- '65.#9.2.14':443
- '24.#.184.239':443
- '65.#9.2.10':443
- '65.#9.2.12':443
UDP:
- DNS ASK jo##.##acwcuv.59yi.info
- DNS ASK ur##.##rrqutq.39zs.info
- DNS ASK au##.##awysqq.4sni.info
- DNS ASK tr##.##fubwcc.5iny.info
- DNS ASK fh##.##uqcfxw.580k.info
- DNS ASK rs#.#2zw.info
- DNS ASK fl####artbyamy.com
- DNS ASK go##le.pl
- DNS ASK go###e.com.au
- DNS ASK go##le.de
- DNS ASK go###e.com.br
- DNS ASK ez##.##bwdedq.525j.info
- DNS ASK go###e.com.my
- DNS ASK fr##gle.com
- DNS ASK rs#.#ddn.info
- DNS ASK go##le.info
- DNS ASK go###e.co.uk
- DNS ASK go###egear.com
- DNS ASK ka##.##wuxffu.51be.info
- DNS ASK go##le.lv
- DNS ASK bj##.##vuzrey.4n3m.info
- DNS ASK go###e.co.nz
- DNS ASK pd##.##yeeacs.51nh.info
- DNS ASK go###e.co.in
- DNS ASK vj##.##yftcxy.512j.info
- DNS ASK wh##.##qafqfx.58jk.info
- DNS ASK yw##.##ttafye.33dv.info
- DNS ASK go##le.by
- DNS ASK go##ge.com
- DNS ASK qj##.##xfdqqs.4eht.info
- DNS ASK me##.##xuutcw.3sct.info
- DNS ASK vw##.##byawuf.2ndn.info
- DNS ASK cb##.##uedwze.23hb.info
- DNS ASK wa##.##vebvwc.3dn3.info
- DNS ASK zm##.##tvqbux.3b3h.info
- DNS ASK go##le.nl
- DNS ASK gj##.##cbxtxs.3asb.info
- DNS ASK zt##.##aqqbey.2huc.info
- DNS ASK ct##.##rdwrsa.265e.info
- DNS ASK st##.##zreaur.3sn3.info
- DNS ASK oi##.##razqtq.5nin.info
- DNS ASK vo##.##zvsqus.31cp.info
- DNS ASK rs#.#107.info
- DNS ASK go##le.mu
- DNS ASK ga##.##btrwve.525j.info
- DNS ASK ds##.##aczdsu.2nex.info
- DNS ASK on##.##fwbuqf.580k.info
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'WispWindowClass' WindowName: '(null)'
