Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,%PROGRAM_FILES%\atxwsjxc\ialxblbg.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\ialxblbg.exe
Modifies master boot record (MBR).
Malicious functions:
Injects code into
the following system processes:
- <SYSTEM32>\ctfmon.exe
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\cscript.exe
- <SYSTEM32>\alg.exe
- <SYSTEM32>\lsass.exe
- <SYSTEM32>\services.exe
- <SYSTEM32>\spoolsv.exe
- <SYSTEM32>\svchost.exe
a large number of user processes.
Searches for registry branches where third party applications store passwords:
- [<HKLM>\Software\Ghisler\Total Commander]
- [<HKLM>\Software\Ghisler\Windows Commander]
- [<HKLM>\Software\FlashFXP]
- [<HKCU>\Software\BPFTP]
- [<HKCU>\Software\FlashFXP]
- [<HKCU>\Software\Ghisler\Total Commander]
- [<HKCU>\SOFTWARE\Far2\Plugins\FTP\Hosts]
- [<HKCU>\SOFTWARE\Far\Plugins\FTP\Hosts]
- [<HKCU>\Software\Far\SavedDialogHistory\FTPHost]
- [<HKCU>\Software\Ghisler\Windows Commander]
- [<HKCU>\Software\Far2\SavedDialogHistory\FTPHost]
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtOpenKey, handler: pontggaf.sys
- NtCreateKey, handler: pontggaf.sys
Modifies settings of Windows Internet Explorer:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1201' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1201' = '00000000'
Modifies file system :
Creates the following files:
- %TEMP%\~TM6.tmp
- %TEMP%\~TM5.tmp
- %TEMP%\pontggaf.sys
- %WINDIR%\Temp\7fffffb1
- %WINDIR%\Temp\6decd52f
- %TEMP%\~TM4.tmp
- %TEMP%\~TM2.tmp
- %TEMP%\~TM1.tmp
- %TEMP%\afkhflgyvyaxadgt.exe
- %PROGRAM_FILES%\atxwsjxc\ialxblbg.exe
- <LS_APPDATA>\jbpeeimr.log
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\ialxblbg.exe
Deletes the following files:
- %TEMP%\~TM5.tmp
- %TEMP%\~TM6.tmp
- %TEMP%\pontggaf.sys
- %TEMP%\~TM1.tmp
- %TEMP%\~TM2.tmp
- %TEMP%\~TM4.tmp
Network activity:
Connects to:
- 'iq###thxsc.com':443
- 'jd#####kgykjiraf.com':443
- 'aa####doogers.com':443
- 'pe####erkoser.com':443
- 'xt#####xoeyqacsrneq.com':443
- 'wm#####etnrhrfec.com':443
- 'hb###mkt.com':443
- 'yo#####futjiugkccio.com':443
- 'ox####uhrmrk.com':443
- 'za####oderkaxk.com':443
- 'xo####hooter.com':443
- '74.##5.232.51':80
- 're####moffies.com':443
- 'ca####doomers.com':443
- 'nu###nertus.com':443
- 'mo#####greetnbpm.com':443
- 've###lkaser.com':443
- 'bo####ckrecoas.com':443
UDP:
- DNS ASK yo#####futjiugkccio.com
- DNS ASK wm#####etnrhrfec.com
- DNS ASK hb###mkt.com
- DNS ASK ox####uhrmrk.com
- DNS ASK jd#####kgykjiraf.com
- DNS ASK xt#####xoeyqacsrneq.com
- DNS ASK dd#####stsvkknvdoh.com
- DNS ASK gp###hsorpe.com
- DNS ASK rg###mukf.com
- DNS ASK yv#####sntbgivyr.com
- DNS ASK qu#####imcamxshj.com
- DNS ASK ln#####nmiaochfuoy.com
- DNS ASK xo####hooter.com
- DNS ASK ca####doomers.com
- DNS ASK ve###lkaser.com
- DNS ASK google.com
- DNS ASK re####moffies.com
- DNS ASK za####oderkaxk.com
- DNS ASK aa####doogers.com
- DNS ASK pe####erkoser.com
- DNS ASK iq###thxsc.com
- DNS ASK bo####ckrecoas.com
- DNS ASK nu###nertus.com
- DNS ASK mo#####greetnbpm.com
