Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'BB892C4B' = '%APPDATA%\BB892C4B\bin.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'BB892C4B' = '%APPDATA%\BB892C4B\bin.exe'
Malicious functions:
Executes the following:
- '<SYSTEM32>\winver.exe'
Injects code into
the following system processes:
- <SYSTEM32>\winver.exe
a large number of user processes.
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
Modifies file system :
Creates the following files:
- %APPDATA%\BB892C4B\bin.exe
Network activity:
Connects to:
- 'rb###fihgfpc.ru':8080
- 'wt###lltwnsy.ru':8080
- 'iq###vrnvvjn.ru':8080
- 'kw###qbmgvox.ru':8080
- 'vs###bbjqbww.ru':8080
- 'bi###wvbovum.ru':8080
- 'rm###hxpcyyx.ru':8080
- 'ey###gsjsdmn.ru':8080
- 'iu###kvgyysn.ru':8080
- 'cx###brffohs.ru':8080
- 'bj###tvnlcuv.ru':8080
- 'gg###oshsool.ru':8080
- 'tf###jkhitll.ru':8080
- 'ev###erssodp.ru':8080
- 'dg###nnrbllo.ru':8080
- 'ji###vgfvsxy.ru':8080
- 'kr###hxqjwgy.ru':8080
- 'fq###vxhsbby.ru':8080
- 'lf###rvwgocl.ru':8080
- 'pd###njjjmbn.ru':8080
- 'qp###jrjwklb.ru':8080
- 'fv###ctrspee.ru':8080
- 'ob###rriiijb.ru':8080
- 'xw###ijxtmuq.ru':8080
- 'pq###mxockhr.ru':8080
- 'ed###foxiqml.ru':8080
- 'oh###erkxmvw.ru':8080
- 'fy###lsnffvu.ru':8080
- 'vw###hsrbold.ru':8080
- 'iv####ivaseeer.biz':8080
- 'cs###hxgwdeb.ru':8080
- 'nk###iriffnc.ru':8080
- 'ri###jjjbtlr.ru':8080
- 'ww###ivpppxx.ru':8080
- 'ry###yuwcvdv.ru':8080
- 'eu###kjbbibk.ru':8080
- 'rq###erjrupl.ru':8080
- 'bn###ogokcfq.ru':8080
- 'cd###wjypwvf.ru':8080
- 'jt###dorbklb.ru':8080
- 'fo###jjgbpod.ru':8080
- 'wj###ebcvtyx.ru':8080
- 'xm###bjmnmlo.ru':8080
- 'ep###ipsyxxo.ru':8080
UDP:
- DNS ASK iq###vrnvvjn.ru
- DNS ASK rb###fihgfpc.ru
- DNS ASK vs###bbjqbww.ru
- DNS ASK lf###rvwgocl.ru
- DNS ASK kw###qbmgvox.ru
- DNS ASK wt###lltwnsy.ru
- DNS ASK iu###kvgyysn.ru
- DNS ASK rm###hxpcyyx.ru
- DNS ASK bj###tvnlcuv.ru
- DNS ASK bi###wvbovum.ru
- DNS ASK cx###brffohs.ru
- DNS ASK ev###erssodp.ru
- DNS ASK gg###oshsool.ru
- DNS ASK ji###vgfvsxy.ru
- DNS ASK ny###ppwrkij.ru
- DNS ASK dg###nnrbllo.ru
- DNS ASK tf###jkhitll.ru
- DNS ASK pd###njjjmbn.ru
- DNS ASK fq###vxhsbby.ru
- DNS ASK fv###ctrspee.ru
- DNS ASK kr###hxqjwgy.ru
- DNS ASK qp###jrjwklb.ru
- DNS ASK ey###gsjsdmn.ru
- DNS ASK ob###rriiijb.ru
- DNS ASK xw###ijxtmuq.ru
- DNS ASK pq###mxockhr.ru
- DNS ASK ed###foxiqml.ru
- DNS ASK oh###erkxmvw.ru
- DNS ASK fy###lsnffvu.ru
- DNS ASK vw###hsrbold.ru
- DNS ASK iv####ivaseeer.biz
- DNS ASK cs###hxgwdeb.ru
- DNS ASK nk###iriffnc.ru
- DNS ASK ri###jjjbtlr.ru
- DNS ASK ww###ivpppxx.ru
- DNS ASK ry###yuwcvdv.ru
- DNS ASK eu###kjbbibk.ru
- DNS ASK rq###erjrupl.ru
- DNS ASK bn###ogokcfq.ru
- DNS ASK cd###wjypwvf.ru
- DNS ASK jt###dorbklb.ru
- DNS ASK fo###jjgbpod.ru
- DNS ASK wj###ebcvtyx.ru
- DNS ASK xm###bjmnmlo.ru
- DNS ASK ep###ipsyxxo.ru
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
