Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,%PROGRAM_FILES%\atxwsjxc\ialxblbg.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\ialxblbg.exe
Malicious functions:
Injects code into
the following system processes:
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\ctfmon.exe
- <SYSTEM32>\alg.exe
- <SYSTEM32>\spoolsv.exe
- <SYSTEM32>\services.exe
- <SYSTEM32>\lsass.exe
- <SYSTEM32>\svchost.exe
the following user processes:
- dekaron.exe
- ClamWin.exe
- drweb.exe
- dnf.exe
- cabalmain.exe
- bdsubmit.exe
- chrome.exe
- ccapp.exe
- egni.exe
- ecmd.exe
- elementclient.exe
- ekrn.exe
- drweb386.exe
- Drweb32w.exe
- Drwebwcl.exe
- Drwebupw.exe
- bdss.exe
- ashAvSrv.exe
- ashAvast.exe
- AVGCC32.EXE
- avgcc.exe
- ageofconan.exe
- __cd75efb816b2cc__.exe
- ash.exe
- aion.exe
- AVPM.EXE
- AVPCC.EXE
- bdagent.exe
- AVSYNMGR.EXE
- AVP.COM
- AVGCTRL.EXE
- AVP32.EXE
- AVP.EXE
Searches for registry branches where third party applications store passwords:
- [<HKLM>\Software\Ghisler\Total Commander]
- [<HKLM>\Software\Ghisler\Windows Commander]
- [<HKLM>\Software\FlashFXP]
- [<HKCU>\Software\BPFTP]
- [<HKCU>\Software\FlashFXP]
- [<HKCU>\Software\Ghisler\Total Commander]
- [<HKCU>\SOFTWARE\Far2\Plugins\FTP\Hosts]
- [<HKCU>\SOFTWARE\Far\Plugins\FTP\Hosts]
- [<HKCU>\Software\Far\SavedDialogHistory\FTPHost]
- [<HKCU>\Software\Ghisler\Windows Commander]
- [<HKCU>\Software\Far2\SavedDialogHistory\FTPHost]
Modifies settings of Windows Internet Explorer:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1201' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1201' = '00000000'
Modifies file system :
Creates the following files:
- %TEMP%\~TM4.tmp
- %PROGRAM_FILES%\atxwsjxc\ialxblbg.exe
- %TEMP%\~TM6.tmp
- %TEMP%\~TM5.tmp
- %TEMP%\~TM2.tmp
- %TEMP%\~TM1.tmp
- <LS_APPDATA>\jbpeeimr.log
- %TEMP%\afkhflgyvyaxadgt.exe
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\ialxblbg.exe
Deletes the following files:
- %TEMP%\~TM5.tmp
- %TEMP%\~TM6.tmp
- %TEMP%\~TM4.tmp
- %TEMP%\~TM1.tmp
- %TEMP%\~TM2.tmp
Network activity:
Connects to:
- 'fa###s-zopa.com':443
- '74.##5.232.51':80
UDP:
- DNS ASK bv###xcfobr.com
- DNS ASK ys#####bqfkvkojv.com
- DNS ASK pl###qjfynt.com
- DNS ASK ky###xbydck.com
- DNS ASK af###gwn.com
- DNS ASK ym####nulihl.com
- DNS ASK lu###txaymj.com
- DNS ASK qw#####kdppgqeha.com
- DNS ASK hq####mvtush.com
- DNS ASK uu####xvihatsr.com
- DNS ASK hk###mpjeg.com
- DNS ASK nt#####fxonbvkqed.com
- DNS ASK ka#####paanwnuopbj.com
- DNS ASK gv#####sdmjqufbfgdg.com
- DNS ASK yp####matxojboh.com
- DNS ASK rh####rmnacbg.com
- DNS ASK eg###jyeasr.com
- DNS ASK si####rsxdqmvq.com
- DNS ASK xe###vlmob.com
- DNS ASK lc####tgdgqoba.com
- DNS ASK bp###gre.com
- DNS ASK tt#####nivtsybduyb.com
- DNS ASK jy###ogwr.com
- DNS ASK cm####kxqgxxtbk.com
- DNS ASK fa###s-zopa.com
- DNS ASK google.com
- DNS ASK as####nbyioy.com
- DNS ASK it####ufaixmin.com
- DNS ASK mw###rlf.com
- DNS ASK lh#####bwenxtyae.com
- DNS ASK cn#####axkredxnk.com
- DNS ASK fm#####irxxgbupuxq.com
- DNS ASK fw#####rvkuqjclvy.com
- DNS ASK wa#####ygowhbdfn.com
- DNS ASK fj####uyyppsei.com
- DNS ASK jr#####kvhgsiyknhw.com
- DNS ASK nt###vejb.com
- DNS ASK la###dbqqr.com
