Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'FlaNtfh8h3stzF3qOQ==' = '"%APPDATA%\Microsoft\cmstp.exe"'
Malicious functions:
Injects code into
the following system processes:
- <SYSTEM32>\ctfmon.exe
- %WINDIR%\Explorer.EXE
a large number of user processes.
Terminates or attempts to terminate
the following user processes:
- safari.exe
- opera.exe
- chrome.exe
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000003'
Modifies file system:
Creates the following files:
- %APPDATA%\Microsoft\cmstp.exe
Deletes itself.
Network activity:
Connects to:
- 'og####43i9.ubd.cc':443
- 'g1###v.vbp.cc':443
- 'n0###obo.vbp.cc':443
- '80####4rfme3.ubd.cc':443
- 'ov####01xct.vbp.cc':443
- '5w###ri7.vbp.cc':443
- '4x####6gu0.gmz.cc':443
- 'la#####fd8h6pd.gmz.cc':443
- 'tf#####xxdl6s.ubd.cc':443
- 'yx#####65k0o5a2.gmz.cc':443
- 'b3####1m24xl.vbp.cc':443
- '29###h0.gmz.cc':443
- '6h#####zd6spty.gmz.cc':443
- '42######h7mmw1qcdq.ubd.cc':443
- '9i#####6ojxut.ubd.cc':443
- 'h3####sn6un.ubd.cc':443
- 'pr####ys064u.gmz.cc':443
- 'rm####tm4po.vbp.cc':443
- 'lm####hunp51.gmz.cc':443
- '4c###59d.ubd.cc':443
- 'lb######4065t0rici.vbp.cc':443
- 'ze####sfl.vbp.cc':443
- 'l8#####rc8qk3l.ubd.cc':443
- '8r#####ezthus.ubd.cc':443
- 'h5###7et.vbp.cc':443
- 'fc#####86zqvfuum.ubd.cc':443
- 'iu####g6zp.vbp.cc':443
- '0w####g1w.vbp.cc':443
- 'gw####5s7wxl.gmz.cc':443
- '3f###4b8.ubd.cc':443
- '1z#####0llfc6x1o.ubd.cc':443
- 'py###if2.vbp.cc':443
- 'la######ko56qyv8v.vbp.cc':443
- '0f#####4h7h97.gmz.cc':443
- '33#####og8mbn9o.gmz.cc':443
- 'nl#####t1kdvi.gmz.cc':443
- 'yf####d39qf2.ubd.cc':443
- 'mz#####8fk04er.gmz.cc':443
- '7p#####s51isu.gmz.cc':443
UDP:
- DNS ASK og####43i9.ubd.cc
- DNS ASK g1###v.vbp.cc
- DNS ASK n0###obo.vbp.cc
- DNS ASK 80####4rfme3.ubd.cc
- DNS ASK ov####01xct.vbp.cc
- DNS ASK 5w###ri7.vbp.cc
- DNS ASK 4x####6gu0.gmz.cc
- DNS ASK la#####fd8h6pd.gmz.cc
- DNS ASK tf#####xxdl6s.ubd.cc
- DNS ASK yx#####65k0o5a2.gmz.cc
- DNS ASK b3####1m24xl.vbp.cc
- DNS ASK 29###h0.gmz.cc
- DNS ASK 6h#####zd6spty.gmz.cc
- DNS ASK 42######h7mmw1qcdq.ubd.cc
- DNS ASK 9i#####6ojxut.ubd.cc
- DNS ASK h3####sn6un.ubd.cc
- DNS ASK pr####ys064u.gmz.cc
- DNS ASK rm####tm4po.vbp.cc
- DNS ASK lm####hunp51.gmz.cc
- DNS ASK 4c###59d.ubd.cc
- DNS ASK lb######4065t0rici.vbp.cc
- DNS ASK ze####sfl.vbp.cc
- DNS ASK l8#####rc8qk3l.ubd.cc
- DNS ASK 8r#####ezthus.ubd.cc
- DNS ASK h5###7et.vbp.cc
- DNS ASK fc#####86zqvfuum.ubd.cc
- DNS ASK iu####g6zp.vbp.cc
- DNS ASK 0w####g1w.vbp.cc
- DNS ASK gw####5s7wxl.gmz.cc
- DNS ASK 3f###4b8.ubd.cc
- DNS ASK 1z#####0llfc6x1o.ubd.cc
- DNS ASK py###if2.vbp.cc
- DNS ASK la######ko56qyv8v.vbp.cc
- DNS ASK 0f#####4h7h97.gmz.cc
- DNS ASK 33#####og8mbn9o.gmz.cc
- DNS ASK nl#####t1kdvi.gmz.cc
- DNS ASK yf####d39qf2.ubd.cc
- DNS ASK mz#####8fk04er.gmz.cc
- DNS ASK 7p#####s51isu.gmz.cc
