Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d9' = '%APPDATA%\1e6f17d9.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d' = 'C:\1e6f17d9\1e6f17d9.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\1e6f17d9.exe
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
Executes the following:
- '<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet
- '<SYSTEM32>\svchost.exe' netsvcs
- '%WINDIR%\explorer.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system :
Creates the following files:
- %APPDATA%\1e6f17d9.exe
- C:\1e6f17d9\1e6f17d9.exe
Network activity:
Connects to:
- 'ja##ab.org':80
- 'co###platt.com':80
- 'cr####heabyss.com':80
- 'fl####ldonline.com':80
- 'da###ystems.com':80
- 'ba###gic.com':80
- 'ho##pop.com':80
- 'hu###itup.com':80
- 'ho#######dbusinesscredit.org':80
- 'fo######matenvermietung.com':80
- 'di###media.com':80
- '2b###eam.com':80
- 'de####amiracle.com':80
- 'de####storage.com':80
- 'br####addesign.com':80
- 'fo######matenverleih.com':80
- 'in#####ngdrummers.com':80
- 'dm###site.pl':80
- 'de#####oconsulting.com':80
- 'am####gweblogos.com':80
- 'el####atterie.com':80
- 'hi##lu.com':80
- 'ct###anila.com':80
- 'ci###eng.com.au':80
- 'am###oinc.com':80
- 'cl######entalanfruns.com':80
- 'gi###-yam.com':80
- 'fo######onssportsplex.org':80
- 'co#####ttraining.com':80
- 'ha###jean.com':80
- 'ea##an.com':80
- 'cu###yip.com':80
- 'my####rnalip.com':80
- 'ip##ddr.es':80
- 'do####ygilstrap.com':80
- 'fa####reations.in':80
- 'go####nacoat.com':80
- 'gc####ancial.com':80
- 'il####urlari.com':80
- 'fo#####sonstraining.com':80
- 'ha###aklaw.com':80
- 'ho####ervices81.fr':80
- 'ca#####g-prestige.be':80
- 'ea###rockey.com':80
- 'cy########landcorporateservices.com':80
- 'cr#####e-interiors.net':80
- 'da####ikestore.be':80
- 'cl#####arcastropol.com':80
- 'dq###.###vage-production.com':80
TCP:
HTTP GET requests:
- http://cu###yip.com/
- http://my####rnalip.com/raw
- http://ip##ddr.es/
HTTP POST requests:
- http://ja##ab.org/1.php?f=###############
- http://co###platt.com/5.php?a=###############
- http://ba###gic.com/3.php?p=###############
- http://fl####ldonline.com/4.php?q=###############
- http://da###ystems.com/4.php?t=###############
- http://cr####heabyss.com/2.php?s=###############
- http://ho##pop.com/1.php?q=###############
- http://hu###itup.com/4.php?a=###############
- http://2b###eam.com/1.php?s=###############
- http://fo######matenvermietung.com/2.php?y=###############
- http://di###media.com/1.php?v=###############
- http://el####atterie.com/1.php?w=###############
- http://de####amiracle.com/5.php?b=###############
- http://de####storage.com/3.php?w=###############
- http://dm###site.pl/5.php?d=###############
- http://fo######matenverleih.com/3.php?w=###############
- http://in#####ngdrummers.com/2.php?m=###############
- http://br####addesign.com/2.php?r=###############
- http://de#####oconsulting.com/4.php?d=###############
- http://am####gweblogos.com/4.php?y=###############
- http://ci###eng.com.au/3.php?c=###############
- http://hi##lu.com/3.php?d=###############
- http://ct###anila.com/1.php?x=###############
- http://ha###jean.com/5.php?n=###############
- http://ea##an.com/2.php?e=###############
- http://co#####ttraining.com/4.php?z=###############
- http://cy########landcorporateservices.com/5.php?b=###############
- http://cr#####e-interiors.net/3.php?v=###############
- http://cl######entalanfruns.com/2.php?j=###############
- http://fa####reations.in/5.php?v=###############
- http://go####nacoat.com/1.php?n=###############
- http://do####ygilstrap.com/4.php?a=###############
- http://gi###-yam.com/2.php?k=###############
- http://fo######onssportsplex.org/1.php?c=###############
- http://ea###rockey.com/1.php?e=###############
- http://ho####ervices81.fr/2.php?s=###############
- http://ca#####g-prestige.be/1.php?h=###############
- http://ha###aklaw.com/4.php?q=###############
- http://ho#######dbusinesscredit.org/5.php?v=###############
- http://am###oinc.com/3.php?m=###############
- http://gc####ancial.com/3.php?j=###############
- http://cl#####arcastropol.com/1.php?q=###############
- http://dq###.###vage-production.com/3.php?t=###############
- http://da####ikestore.be/1.php?j=###############
- http://il####urlari.com/3.php?m=###############
- http://fo#####sonstraining.com/5.php?f=###############
UDP:
- DNS ASK ja##ab.org
- DNS ASK co###platt.com
- DNS ASK cr####heabyss.com
- DNS ASK fl####ldonline.com
- DNS ASK da###ystems.com
- DNS ASK ba###gic.com
- DNS ASK ho##pop.com
- DNS ASK hu###itup.com
- DNS ASK ho#######dbusinesscredit.org
- DNS ASK fo######matenvermietung.com
- DNS ASK di###media.com
- DNS ASK 2b###eam.com
- DNS ASK de####amiracle.com
- DNS ASK de####storage.com
- DNS ASK br####addesign.com
- DNS ASK fo######matenverleih.com
- DNS ASK in#####ngdrummers.com
- DNS ASK dm###site.pl
- DNS ASK de#####oconsulting.com
- DNS ASK am####gweblogos.com
- DNS ASK el####atterie.com
- DNS ASK hi##lu.com
- DNS ASK ct###anila.com
- DNS ASK ci###eng.com.au
- DNS ASK am###oinc.com
- DNS ASK cl######entalanfruns.com
- DNS ASK gi###-yam.com
- DNS ASK fo######onssportsplex.org
- DNS ASK co#####ttraining.com
- DNS ASK ha###jean.com
- DNS ASK ea##an.com
- DNS ASK cu###yip.com
- DNS ASK my####rnalip.com
- DNS ASK ip##ddr.es
- DNS ASK do####ygilstrap.com
- DNS ASK fa####reations.in
- DNS ASK go####nacoat.com
- DNS ASK gc####ancial.com
- DNS ASK il####urlari.com
- DNS ASK fo#####sonstraining.com
- DNS ASK ha###aklaw.com
- DNS ASK ho####ervices81.fr
- DNS ASK ca#####g-prestige.be
- DNS ASK ea###rockey.com
- DNS ASK cy########landcorporateservices.com
- DNS ASK cr#####e-interiors.net
- DNS ASK da####ikestore.be
- DNS ASK cl#####arcastropol.com
- DNS ASK dq###.###vage-production.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
