Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'pmshdkes' = '%APPDATA%\pmshdkes\fyomlice.vbs'
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\wscript.exe' "%APPDATA%\pmshdkes\mfvcjdqy.vbs"
Executes the following:
- '%ProgramFiles%\Windows Media Player\wmplayer.exe'
Injects code into
the following user processes:
- wmplayer.exe
Modifies file system:
Creates the following files:
- %APPDATA%\pmshdkes\fyomlice.vbs
- %APPDATA%\pmshdkes\xphtnnkj.exe
- %APPDATA%\pmshdkes\brkkfstl.ps1
- %APPDATA%\pmshdkes\mfvcjdqy.vbs
- %TEMP%\~TM1.tmp
- %ALLUSERSPROFILE%\Application Data\kdgihdcp.log
- <LS_APPDATA>\wcxnjluo.log
Deletes the following files:
- %APPDATA%\pmshdkes\mfvcjdqy.vbs
- %TEMP%\~TM1.tmp
Network activity:
Connects to:
- 'ks##toxe.eu':442
- 'rb#####baaxymslioa.eu':442
- 'gt#####dpunrxvlvc.eu':442
- 'ts###trsajq.eu':442
- 'rm###qktu.eu':442
- 'pm#####wxcphvwjxmtn.eu':442
- 'ej####bbfamacnh.eu':442
- 'pc###ecumd.eu':442
- 'uk#####iodrnkgdtg.eu':442
- 'uj###erct.eu':442
- 'gb####ougomlm.eu':442
- 'fq####ypspirrwlf.eu':442
- 'eq###nthsl.eu':442
- 'dx###wqys.eu':442
- 'lh####lschvepte.eu':442
- 'xj####thqbhgnkp.eu':442
- 'hv#####esttrappblgj.eu':442
- 'vc####sghqsugunp.eu':442
- 'ib####kbxeyutka.eu':442
- 'uc#####kikailwuvg.eu':442
- 're#####cntppxvjiqep.eu':442
- 'pb###gmvknw.eu':442
- 'hm###rstrgid.eu':442
- 'yx###ekrf.eu':442
- 'me###mqsynot.eu':442
- '12#.#25.114.144':80
- 'of###qtlmm.eu':442
- 'cb#####dtwrmdtphghq.eu':442
- 'yg####dsclptuo.eu':442
- 'cw#####tbeachtlfno.eu':442
- 'ti#####vcghknnfceqn.eu':442
- 'pr####idxvsniry.eu':442
- 'xs####emxlcvql.eu':442
- 'fh####xthpbxsmt.eu':442
- 've#####wnwwdybmip.eu':442
- 'ns###klcmr.eu':442
- 'ho####stfuxpoq.eu':442
- 'gv##jsfi.eu':442
UDP:
- DNS ASK ks##toxe.eu
- DNS ASK rb#####baaxymslioa.eu
- DNS ASK gt#####dpunrxvlvc.eu
- DNS ASK ts###trsajq.eu
- DNS ASK rm###qktu.eu
- DNS ASK pm#####wxcphvwjxmtn.eu
- DNS ASK ej####bbfamacnh.eu
- DNS ASK pc###ecumd.eu
- DNS ASK uk#####iodrnkgdtg.eu
- DNS ASK uj###erct.eu
- DNS ASK gb####ougomlm.eu
- DNS ASK fq####ypspirrwlf.eu
- DNS ASK eq###nthsl.eu
- DNS ASK dx###wqys.eu
- DNS ASK lh####lschvepte.eu
- DNS ASK xj####thqbhgnkp.eu
- DNS ASK hv#####esttrappblgj.eu
- DNS ASK vc####sghqsugunp.eu
- DNS ASK ib####kbxeyutka.eu
- DNS ASK uc#####kikailwuvg.eu
- DNS ASK re#####cntppxvjiqep.eu
- DNS ASK pb###gmvknw.eu
- DNS ASK hm###rstrgid.eu
- DNS ASK yx###ekrf.eu
- DNS ASK me###mqsynot.eu
- DNS ASK ba##u.com
- DNS ASK of###qtlmm.eu
- DNS ASK cb#####dtwrmdtphghq.eu
- DNS ASK yg####dsclptuo.eu
- DNS ASK cw#####tbeachtlfno.eu
- DNS ASK ti#####vcghknnfceqn.eu
- DNS ASK pr####idxvsniry.eu
- DNS ASK xs####emxlcvql.eu
- DNS ASK fh####xthpbxsmt.eu
- DNS ASK ve#####wnwwdybmip.eu
- DNS ASK ns###klcmr.eu
- DNS ASK ho####stfuxpoq.eu
- DNS ASK gv##jsfi.eu
