Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'sfF3hHoszkLvC0jfFCeS' = '"%APPDATA%\Microsoft\MMC\clipbrd.exe"'
Malicious functions:
Injects code into
the following system processes:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\cscript.exe
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\ctfmon.exe
a large number of user processes.
Terminates or attempts to terminate
the following user processes:
- safari.exe
- opera.exe
- chrome.exe
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000003'
Modifies file system :
Creates the following files:
- %APPDATA%\Microsoft\MMC\clipbrd.exe
Deletes itself.
Network activity:
Connects to:
- 'tk#####1tuq5ny.vbp.cc':443
- 'eq#####eryoh7rxu.vbp.cc':443
- '1g#####m859dl7o8.vbp.cc':443
- 'ol######ds8qpfgn2y.vbp.cc':443
- 'ol#####geokrmm.vbp.cc':443
- 'm4####1vq41z.ubd.cc':443
- 'es#####fd42nuao.gmz.cc':443
UDP:
- DNS ASK vb###s5.ubd.cc
- DNS ASK o0####qjbbb.vbp.cc
- DNS ASK n8####px5y5.vbp.cc
- DNS ASK h7#####r5e9y8.gmz.cc
- DNS ASK z8#####swqmx49n.gmz.cc
- DNS ASK de####803.gmz.cc
- DNS ASK fm######4s9f5dmzn.gmz.cc
- DNS ASK 8v######v9xcowkjp.ubd.cc
- DNS ASK n4#####oklegv.vbp.cc
- DNS ASK vq####cpqd.ubd.cc
- DNS ASK db#####048iv5.gmz.cc
- DNS ASK 7i####9jne.ubd.cc
- DNS ASK 18###za.ubd.cc
- DNS ASK zg#####x1ji8a.vbp.cc
- DNS ASK sa####vzflqh.vbp.cc
- DNS ASK 8n####pg47p.vbp.cc
- DNS ASK c2###fv5.gmz.cc
- DNS ASK mv#####oetr8t.gmz.cc
- DNS ASK ht#####2quigqm.ubd.cc
- DNS ASK 1g#####m859dl7o8.vbp.cc
- DNS ASK eq#####eryoh7rxu.vbp.cc
- DNS ASK 8y###b.ubd.cc
- DNS ASK qx####oe5m1.ubd.cc
- DNS ASK tk#####1tuq5ny.vbp.cc
- DNS ASK m4####1vq41z.ubd.cc
- DNS ASK ol#####geokrmm.vbp.cc
- DNS ASK ol######ds8qpfgn2y.vbp.cc
- DNS ASK es#####fd42nuao.gmz.cc
- DNS ASK 2b#####gsdtwll.ubd.cc
- DNS ASK nu#####vesrj2yu.vbp.cc
- DNS ASK us###g1.vbp.cc
- DNS ASK 9o#####qyugyd.ubd.cc
- DNS ASK 3z###ig.ubd.cc
- DNS ASK yz###22.gmz.cc
- DNS ASK gk#####3qzlqe4t7.gmz.cc
- DNS ASK s0####k2oj.ubd.cc
- DNS ASK 4e#####p97mpdit.gmz.cc
- DNS ASK nx#####5kfj3u7d.gmz.cc
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
