Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = '{43,3a,5c,57,49,4e,44,4f,57,53,5c,73,79,73,74,65,6d,33,32,5c,45,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = '{43,3a,5c,57,49,4e,44,4f,57,53,5c,73,79,73,74,65,6d,33,32,5c,45,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{43,3a,5c,57,49,4e,44,4f,57,53,5c,73,79,73,74,65,6d,33,32,5c,45,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{43,3a,5c,57,49,4e,44,4f,57,53,5c,73,79,73,74,65,6d,33,32,5c,45,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{43,3a,5c,57,49,4e,44,4f,57,53,5c,73,79,73,74,65,6d,33,32,5c,45,...
Modifies file system:
Creates the following files:
- <SYSTEM32>\ESPI11.dll
- <Current directory>\ESPI11.dll
Deletes the following files:
- <Current directory>\ESPI11.dll
Network activity:
Connects to:
- 'www.wa##ang.com':80
- 'www.qi###sha.com':80
- 'www.rd##zz.com':80
TCP:
HTTP GET requests:
- http://www.qi###sha.com/soft.txt
- http://www.rd##zz.com/v1/data/link_conv/rd_dispatcher.php?or###############################
HTTP POST requests:
- http://www.wa##ang.com/index.php/url/shorten
UDP:
- DNS ASK www.wa##ang.com
- DNS ASK www.qi###sha.com
- DNS ASK www.rd##zz.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'SysDateTimePick32' WindowName: ''
- ClassName: 'SysIPAddress32' WindowName: ''
- ClassName: 'SysTreeView32' WindowName: ''
- ClassName: 'msctls_updown32' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'SysHeader32' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'Edit' WindowName: ''
- ClassName: 'BUTTON' WindowName: ''
- ClassName: '' WindowName: 'crossfire.exe'
- ClassName: 'ComboBox' WindowName: ''
- ClassName: 'ListBox' WindowName: ''
- ClassName: 'msctls_progress32' WindowName: ''
- ClassName: 'msctls_trackbar32' WindowName: ''
