Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'FireFoxUpdServeisSystem' = '"%APPDATA%\FireFoxUpdServeis\Microsoft_ritolimewi.exe"'
Malicious functions:
Executes the following:
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' -k -noframemerging http://sc###i0n.run
- '<SYSTEM32>\svchost.exe'
Injects code into
the following system processes:
Modifies file system :
Creates the following files:
- %APPDATA%\FireFoxUpdServeis\Microsoft_ritolimewi.exe
Deletes itself.
Network activity:
Connects to:
- 'localhost':1042
- 'go##le.de':80
- 'tw##ter.com':443
UDP:
- DNS ASK go##le.de
- DNS ASK tw##ter.com
- '31.##8.220.4':44555
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'Internet Explorer Security'
- ClassName: '' WindowName: 'Internet Explorer - Security Warning'
- ClassName: '' WindowName: 'Windows Security Warning'
- ClassName: '' WindowName: 'Windows Security Alert'
- ClassName: '' WindowName: 'Internet Explorer 11'
- ClassName: '' WindowName: 'Internet Explorer 10'
- ClassName: '' WindowName: 'Set Up Windows Internet Explorer'
- ClassName: '' WindowName: 'Internet Explorer 8'
- ClassName: '' WindowName: 'Internet Explorer 9'
- ClassName: '' WindowName: 'Internet Explorer'
- ClassName: '' WindowName: 'Security'
- ClassName: '' WindowName: 'Windows Internet Explorer 10'
- ClassName: '' WindowName: 'Windows Internet Explorer 11'
- ClassName: '' WindowName: 'Security Alert'
- ClassName: '' WindowName: 'Security Information'
- ClassName: '' WindowName: 'Warning - Security'
- ClassName: '' WindowName: 'Security Warning'
- ClassName: '' WindowName: 'Windows Security'
- ClassName: '' WindowName: 'Phishing Filter'
- ClassName: '' WindowName: 'Microsoft Phishing Filter'
- ClassName: '' WindowName: 'JavaScript Alert'
- ClassName: '' WindowName: 'Information Bar'
- ClassName: '' WindowName: 'Webpage unavailable while offline'
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: 'Set Up Windows Internet Explorer 10'
- ClassName: '' WindowName: 'Set Up Windows Internet Explorer 11'
- ClassName: '' WindowName: 'Set Up Windows Internet Explorer 8'
- ClassName: '' WindowName: 'Set Up Windows Internet Explorer 9'
- ClassName: '' WindowName: 'About Internet Explorer'
- ClassName: '' WindowName: 'Internet Explorer Alert'
- ClassName: '' WindowName: 'Microsoft Internet Explorer'
- ClassName: '' WindowName: 'Message from webpage'
- ClassName: '' WindowName: 'Internet Explorer Alert!'
- ClassName: '' WindowName: 'Windows Internet Explorer 9'
- ClassName: '' WindowName: 'Warning!'
- ClassName: '' WindowName: 'Reflect'
- ClassName: '' WindowName: 'Internet Connection Error'
- ClassName: '' WindowName: 'Warning'
- ClassName: '' WindowName: 'Work Offline'
- ClassName: '' WindowName: 'Pop-up Blocker'
- ClassName: '' WindowName: 'Manage Add-ons'
- ClassName: '' WindowName: 'Windows Network Diagnostics'
- ClassName: '' WindowName: 'Microsoft SmartScreen Filter'
- ClassName: '' WindowName: 'Add Search Provider'
- ClassName: '' WindowName: 'Internet Explorer - Search Provider Default'
- ClassName: 'Indicator' WindowName: ''
- ClassName: '' WindowName: 'Adobe Flash Player'
- ClassName: '' WindowName: 'Add Search Engine'
- ClassName: '' WindowName: 'Google Toolbar is Disabled'
- ClassName: '' WindowName: 'Connection Error'
- ClassName: '' WindowName: 'Privacy Alert'
- ClassName: '' WindowName: 'Set up Internet Explorer'
- ClassName: '' WindowName: 'Internet Explorer Script Error'
- ClassName: '' WindowName: 'Script Error'
- ClassName: '' WindowName: 'Add or Change Home Page'
- ClassName: '' WindowName: 'Debugging Requires Webpage Refresh'
- ClassName: '' WindowName: 'Webpage Error'
- ClassName: '' WindowName: 'Windows Internet Explorer'
- ClassName: '' WindowName: 'Windows Internet Explorer 8'
- ClassName: '' WindowName: 'Error'
- ClassName: '' WindowName: 'Web Browser'
- ClassName: '' WindowName: 'Properties'
- ClassName: '' WindowName: 'Privacy Report'
- ClassName: '' WindowName: 'Compatibility View Settings'
- ClassName: '' WindowName: 'Import/Export Settings'
- ClassName: '' WindowName: 'iexplore.exe - Application Error'
- ClassName: '' WindowName: 'Windows Internet Explorer Platform Preview Setup'
- ClassName: '' WindowName: 'Delete Home Page'
- ClassName: '' WindowName: 'SYSFader: iexplore.exe - Application Error'
- ClassName: '' WindowName: 'iexplore.exe - Entry Point Not Found'
