Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d9' = '%APPDATA%\1e6f17d9.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d' = 'C:\1e6f17d9\1e6f17d9.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\1e6f17d9.exe
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
Executes the following:
- '<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet
- '<SYSTEM32>\svchost.exe' netsvcs
- '%WINDIR%\explorer.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system :
Creates the following files:
- %APPDATA%\1e6f17d9.exe
- C:\1e6f17d9\1e6f17d9.exe
Network activity:
Connects to:
- 'mo####fromspain.com':80
- 'in####llions.com':80
- 'vi####anservisi.com':80
- 'th####meindex.com':80
- 'st####arbrand.co':80
- 'pa###aina.ru':80
- 'bi####tgiveaway.com':80
- 'rh#######supplierkosmetik.com':80
- 'do####-capital.info':80
- 'ho#########cocainestayinyoursystem.org':80
- 'mo###ser.com':80
- 'so######using.modulo.net':80
- 'vo###metmoi.com':80
- 've#####cipesworld.com':80
- 'mo####kechar.com':80
- 'st##ena.ru':80
- 'be######osting-smart.com':80
- 'sa#####faototamir.com':80
- 'ni####evolved.com':80
- 'ip##ddr.es':80
- 'my####rnalip.com':80
- 'cu###yip.com':80
- 'sp####stache.com':80
- 'bi###netweb.com':80
- 'fo####nnecting.com':80
- 'pr##soya.ru':80
- 'sl#.it':80
- 'sw###babes.ru':80
- 'no#####ltipropiedad.com':80
- 'al######gasurvivalgear.com':80
TCP:
HTTP GET requests:
- http://cu###yip.com/
- http://my####rnalip.com/raw
- http://ip##ddr.es/
HTTP POST requests:
- http://in####llions.com/wp-content/uploads/js_composer/.X1-unix/03a/2.php?v=##########
- http://vi####anservisi.com/wp-content/themes/perspectivewp/functions/pagebuilder/functions/metaboxes/js/2.php?s=##########
- http://rh#######supplierkosmetik.com/wp-content/plugins/wordpress-seo/vendor/composer/installers/tests/Composer/4.php?e=##########
- http://bi####tgiveaway.com/wp-content/plugins/js_composer/inline/assets/vc/social/tw/3.php?n=##########
- http://th####meindex.com/wp-content/themes/ublog/options/ReduxCore/inc/validation/preg_replace/2.php?k=##########
- http://mo####fromspain.com/wp-content/themes/diva-final/assets/bootstrap-master/docs/examples/starter-template/4.php?k=##########
- http://vo###metmoi.com/wp-includes/js/tinymce/plugins/compat3x/css/5.php?f=##########
- http://do####-capital.info/wp-content/plugins/growposition/phpseclib0.2.2/PHP/Compat/Function/5.php?z=##########
- http://ho#########cocainestayinyoursystem.org/wp-content/plugins/backupbuddy/destinations/sftp/lib/phpseclib/File/3.php?z=##########
- http://mo###ser.com/wp-content/plugins/wordpress-backup-to-dropbox/Dropbox/Dropbox/OAuth/Consumer/5.php?k=##########
- http://ve#####cipesworld.com/wp-content/plugins/ultimate-product-catalogue/PHPExcel/Classes/PHPExcel/locale/de/5.php?s=##########
- http://mo####kechar.com/fichiers/apps/files_pdfviewer/vendor/pdfjs/web/locale/my/4.php?g=##########
- http://so######using.modulo.net/wp-content/uploads/gravity_forms/1-030f8fd0723e0cf70769a201fdd11b75/tmp/2.php?y=##########
- http://pa###aina.ru/wp-includes/js/tinymce/themes/advanced/skins/wp_theme/img/4.php?c=##########
- http://sa#####faototamir.com/wp-content/plugins/simple-tags/assets/js/lib/jquery.autocomplete/4.php?g=##########
- http://sp####stache.com/wp-content/uploads/gravity_forms/1-7a320e64883203f22a4e76de83776fc3/tmp/2.php?z=##########
- http://sw###babes.ru/catalog/view/theme/beamstore/skins/store_default/Watches/js/5.php?f=##########
- http://ni####evolved.com/wp-content/plugins/easyblogging/themes/stripes_orange/assets/icons/theme_icons/5.php?c=##########
- http://st##ena.ru/wp-content/plugins/fusion-core/admin/page-builder/assets/fonts/fonts/5.php?i=##########
- http://be######osting-smart.com/wp-content/themes/blogolife/functions/be/images/icons/4.php?k=##########
- http://no#####ltipropiedad.com/wp-content/plugins/security-ninja-core-scanner-addon/documentation/assets/blueprint-css/plugins/fancy-type/3.php?q=##########
- http://fo####nnecting.com/wp-content/plugins/easy-contact-forms/js/tinymce/themes/advanced/skins/4.php?j=##########
- http://pr##soya.ru/fancybox/__pages_sources/2.php?n=##########
- http://st####arbrand.co/wp-content/plugins/better-wp-security/modules/free/away-mode/css/smoothness/5.php?a=##########
- http://al######gasurvivalgear.com/wp-content/plugins/js_composer/assets/lib/bower/vcIconPicker/css/4.php?b=##########
- http://sl#.it/wp-content/upgrade/wp-maintenance-mode.tmp/wp-maintenance-mode/assets/images/.X1-unix/de1/4.php?s=##########
- http://bi###netweb.com/casper/wp-content/themes/envision-parent/framework/extensions/reservationform/config/3.php?q=##########
UDP:
- DNS ASK mo####fromspain.com
- DNS ASK in####llions.com
- DNS ASK vi####anservisi.com
- DNS ASK th####meindex.com
- DNS ASK st####arbrand.co
- DNS ASK pa###aina.ru
- DNS ASK bi####tgiveaway.com
- DNS ASK rh#######supplierkosmetik.com
- DNS ASK do####-capital.info
- DNS ASK ho#########cocainestayinyoursystem.org
- DNS ASK mo###ser.com
- DNS ASK so######using.modulo.net
- DNS ASK vo###metmoi.com
- DNS ASK ve#####cipesworld.com
- DNS ASK mo####kechar.com
- DNS ASK st##ena.ru
- DNS ASK be######osting-smart.com
- DNS ASK sa#####faototamir.com
- DNS ASK ni####evolved.com
- DNS ASK ip##ddr.es
- DNS ASK my####rnalip.com
- DNS ASK cu###yip.com
- DNS ASK sp####stache.com
- DNS ASK bi###netweb.com
- DNS ASK fo####nnecting.com
- DNS ASK pr##soya.ru
- DNS ASK sl#.it
- DNS ASK sw###babes.ru
- DNS ASK no#####ltipropiedad.com
- DNS ASK al######gasurvivalgear.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
