Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSrv] 'ImagePath' = '<SYSTEM32>\WinSrv.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSrv] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\WinSrv.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' del <Full path to virus> >> NUL
- '<SYSTEM32>\svchost.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system:
Creates the following files:
- <SYSTEM32>\WinSrv.exe
Deletes itself.
Network activity:
Connects to:
- 'ne##rit.com':443
- 'pa##rug.com':443
- 'am##im.com':443
- 'vs###pizdy.ru':443
- 'pi###-vsem.ru':443
- 'ek##po.ru':443
- 'fa#####viceworld.com':443
- 'al##tel.ru':443
- 'ep##fin.ru':443
- 'oz##ol.ru':443
- 'pe###dmithen.ru':443
- 'to####tinsup.com':443
- 'ce###opbo.ru':443
- 'to###ehen.com':443
- 'ro###rabdidn.ru':443
- 'wi####shedspar.ru':443
- 'pi###-sem.ru':443
- 'ce###otof.ru':443
- 're###downty.com':443
- 'he###tloran.ru':443
- 'we###rtales.ru':443
- 'se####atmiru.com':443
- 'la###leftre.ru':443
- 'sw###awert.com':443
- 'pe###nasconn.ru':443
- 've###rusural.ru':443
- 'xa###pefgr.ru':443
- 'li###refa.ru':443
- 'ta###zuwek.ru':443
- 'mi###tubiv.ru':443
- 'we###ubaz.ru':443
- 'fo###whell.ru':443
- 'fi####upworlds.com':443
- 'go###tforus.ru':443
- 'sh###worlds.ru':443
- 'se###lefnom.ru':443
- 'se####glandam.ru':443
- 're####ratormira.ru':443
- 'we###tumbahn.ru':443
- 'sp###anwore.com':443
- 'as####rspace.com':443
UDP:
- DNS ASK ne##rit.com
- DNS ASK pa##rug.com
- DNS ASK am##im.com
- DNS ASK vs###pizdy.ru
- DNS ASK pi###-vsem.ru
- DNS ASK ek##po.ru
- DNS ASK fa#####viceworld.com
- DNS ASK al##tel.ru
- DNS ASK ep##fin.ru
- DNS ASK oz##ol.ru
- DNS ASK pe###dmithen.ru
- DNS ASK to####tinsup.com
- DNS ASK ce###opbo.ru
- DNS ASK to###ehen.com
- DNS ASK ro###rabdidn.ru
- DNS ASK wi####shedspar.ru
- DNS ASK pi###-sem.ru
- DNS ASK ce###otof.ru
- DNS ASK re###downty.com
- DNS ASK he###tloran.ru
- DNS ASK we###rtales.ru
- DNS ASK se####atmiru.com
- DNS ASK la###leftre.ru
- DNS ASK sw###awert.com
- DNS ASK pe###nasconn.ru
- DNS ASK ve###rusural.ru
- DNS ASK xa###pefgr.ru
- DNS ASK li###refa.ru
- DNS ASK ta###zuwek.ru
- DNS ASK mi###tubiv.ru
- DNS ASK we###ubaz.ru
- DNS ASK fo###whell.ru
- DNS ASK fi####upworlds.com
- DNS ASK go###tforus.ru
- DNS ASK sh###worlds.ru
- DNS ASK se###lefnom.ru
- DNS ASK se####glandam.ru
- DNS ASK re####ratormira.ru
- DNS ASK we###tumbahn.ru
- DNS ASK sp###anwore.com
- DNS ASK as####rspace.com
