Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'jixhoframuaj' = '%HOMEPATH%\jixhoframuaj.exe'
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\stermedia[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\xlp.org[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\dicre[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\aqarea[1].htm
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\e39280a1-1314-4cb7-98b8-bc06e9f10308
- %HOMEPATH%\jixhoframuaj.exe
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\jixhoframuaj.exe
Deletes the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\aqarea[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\dicre[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\xlp.org[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\stermedia[1].htm
Network activity:
Connects to:
- 'aq##ea.com':80
- 'di##e.com':80
- 'xl#.org.uk':80
- 'st###edia.pl':80
TCP:
HTTP POST requests:
- aq##ea.com/
- di##e.com/
- xl#.org.uk/
- st###edia.pl/
UDP:
- DNS ASK vi##on.com
- DNS ASK ho##e.ch
- DNS ASK el##ts.com
- DNS ASK ti##top.cz
- DNS ASK da##nne.ro
- DNS ASK he###ter.com
- DNS ASK on##odo.net
- DNS ASK de###ins.org
- DNS ASK ch##o.ru
- DNS ASK se##ema.com
- DNS ASK co##f.com
- DNS ASK mv##rlm.com
- DNS ASK ar#f.de
- DNS ASK in###hard.pt
- DNS ASK ks##.com
- DNS ASK uv###ndia.in
- DNS ASK ab##.com
- DNS ASK 4j##.com
- DNS ASK nc#l.cc
- DNS ASK jo###bia.com
- DNS ASK mu##c.us
- DNS ASK le##atan.pl
- DNS ASK nm##ie.com
- DNS ASK bo###.com.tr
- DNS ASK va##nex.hu
- DNS ASK go###rop.com
- DNS ASK mo##eux.fr
- DNS ASK de##ai.com
- DNS ASK ba###dek.com
- DNS ASK mu##ip.hu
- DNS ASK he##nc.com
- DNS ASK lp##om.pt
- DNS ASK 10##otel.is
- DNS ASK ii##d.org
- DNS ASK er##gal.com
- DNS ASK ki##cr.com
- DNS ASK ag##an.net
- DNS ASK k-##sin.com
- DNS ASK ec##.com.au
- DNS ASK st##c.co.uk
- DNS ASK me###tes.com
- DNS ASK bu##ebt.net
- DNS ASK at##m.ru
- DNS ASK lm##.org.au
- DNS ASK aq##ea.com
- DNS ASK di##e.com
- DNS ASK xl#.org.uk
- DNS ASK st###edia.pl
- DNS ASK ta##ra.net
- DNS ASK k-###aku.com
- DNS ASK zy##on.com
- DNS ASK fa###.com.tr
- DNS ASK oo###anj.com
- DNS ASK pm##.org
- DNS ASK to##ys.com
- DNS ASK so###n.co.jp
- DNS ASK x9#.com
- DNS ASK ba##jya.com
- DNS ASK pl##i.net
- DNS ASK dz#.cz
- DNS ASK kt##tam.com
- DNS ASK ac###ich.org
- DNS ASK hb##ail.com
- DNS ASK jo##me.net
- DNS ASK at##lit.com
- DNS ASK vi##el.net
- DNS ASK in###disc.de
- DNS ASK co##val.es
- DNS ASK pl##.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: '(null)'
