Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
adds antivirus exclusion with following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{AD9EC2D6-7EAA-4CD4-A50D-FDA71AB589B3}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = ...
- [<HKLM>\Software\Policies\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = ''
Executes the following
- '%WINDIR%\syswow64\at.exe' 3874982763784yhwgdfg78234789s42809374918uf
Modifies file system
Creates the following files
- %WINDIR%\syswow64\grouppolicy\gpt.ini
- %HOMEPATH%\pictures\minor policy\te9ud86uzqukkz3ma_xm3_zt.exe
- %HOMEPATH%\pictures\minor policy\97fspo7_qgnodyjtjtnt7bej.exe
- %HOMEPATH%\pictures\minor policy\tiq67tq3qpqhqc6np6p5t679.exe
- %HOMEPATH%\pictures\minor policy\qdiwo6rxblhk_ojwul1g3qhv.exe
- %HOMEPATH%\pictures\minor policy\7h7yezrhfqzv73fs0euw_bem.exe
- %HOMEPATH%\pictures\minor policy\p8qqtmrenyb7xya1acm6clli.exe
- %HOMEPATH%\pictures\minor policy\pqpaahptclt809wxi0l6s_dg.exe
- %HOMEPATH%\pictures\minor policy\y28zqrhfd9dsah9l1fgmk00h.exe
- %HOMEPATH%\pictures\minor policy\7vgo74efvf9tfwjlbhwjmdtw.exe
- %HOMEPATH%\pictures\minor policy\noy2rwkolqmq_qmwjrnat34s.exe
- %HOMEPATH%\pictures\minor policy\e6ysmzlneafjowuzrwgttdsm.exe
- %HOMEPATH%\pictures\minor policy\17w1lgemvximd0l6gehn46vm.exe
Substitutes the following files
- %ALLUSERSPROFILE%\ntuser.pol
Network activity
Connects to
- 'ko####-24.online':80
- 'x1.#.lencr.org':80
- 'su####1.userapi.com':443
- 'as###asss.autos':443
- 'kk#.##waggee.com':443
- 'ps##.#serapi.com':443
- 'as###asss.autos':80
- 'kk#.##waggee.com':80
- 'gu#####imnstrannaer.net':80
- '19#.#8.108.112':80
- '17#.#2.30.79':80
- '10#.#82.129.251':80
- '77.##.134.15':80
- '95.##4.24.96':80
- 'microsoft.com':80
- 'vk.com':443
- 'vk.com':80
- 'ip##fo.io':443
- 'oc##.thawte.com':80
- 'x2.#.lencr.org':80
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://ko####-24.online/api/tracemap.php
- http://19#.#8.108.112/setup.exe
- http://gu#####imnstrannaer.net/dl/6523.exe
- http://10#.#82.129.251/download/Service.exe
- http://95.##4.24.96/load.php?pu#########
- http://17#.#2.30.79/files/Une1.exe
- http://77.##.134.15/vr/Galaxy.exe
- http://x1.#.lencr.org/
- http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D
- http://x2.#.lencr.org/
Other
- 'ip##fo.io':443
- 'vk.com':80
- 'vk.com':443
- 'kk#.##waggee.com':80
- 'as###asss.autos':80
- 'ps##.#serapi.com':443
- 'kk#.##waggee.com':443
- 'as###asss.autos':443
- 'su####1.userapi.com':443
UDP
- DNS ASK ko####-24.online
- DNS ASK ip##fo.io
- DNS ASK vk.com
- DNS ASK microsoft.com
- DNS ASK as###asss.autos
- DNS ASK gu#####imnstrannaer.net
- DNS ASK kk#.##waggee.com
- DNS ASK ps##.#serapi.com
- DNS ASK su####1.userapi.com
- DNS ASK public-trust.com
- DNS ASK x1.#.lencr.org
- DNS ASK oc##.thawte.com
- DNS ASK x2.#.lencr.org
Miscellaneous
Creates and executes the following
- '%HOMEPATH%\pictures\minor policy\tiq67tq3qpqhqc6np6p5t679.exe'
- '%HOMEPATH%\pictures\minor policy\qdiwo6rxblhk_ojwul1g3qhv.exe'
- '%HOMEPATH%\pictures\minor policy\noy2rwkolqmq_qmwjrnat34s.exe'
- '%HOMEPATH%\pictures\minor policy\7vgo74efvf9tfwjlbhwjmdtw.exe'
- '%HOMEPATH%\pictures\minor policy\17w1lgemvximd0l6gehn46vm.exe'
- '%HOMEPATH%\pictures\minor policy\e6ysmzlneafjowuzrwgttdsm.exe'
- '%HOMEPATH%\pictures\minor policy\97fspo7_qgnodyjtjtnt7bej.exe'
- '%HOMEPATH%\pictures\minor policy\y28zqrhfd9dsah9l1fgmk00h.exe'
- '%HOMEPATH%\pictures\minor policy\te9ud86uzqukkz3ma_xm3_zt.exe'
- '%HOMEPATH%\pictures\minor policy\pqpaahptclt809wxi0l6s_dg.exe'
- '%HOMEPATH%\pictures\minor policy\p8qqtmrenyb7xya1acm6clli.exe'
- '%HOMEPATH%\pictures\minor policy\7vgo74efvf9tfwjlbhwjmdtw.exe' ' (with hidden window)
- '%WINDIR%\syswow64\at.exe' 3874982763784yhwgdfg78234789s42809374918uf' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\p8qqtmrenyb7xya1acm6clli.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\tiq67tq3qpqhqc6np6p5t679.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\e6ysmzlneafjowuzrwgttdsm.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\noy2rwkolqmq_qmwjrnat34s.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\97fspo7_qgnodyjtjtnt7bej.exe' ' (with hidden window)
- '%TEMP%\ixp000.tmp\setup_~1.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\qdiwo6rxblhk_ojwul1g3qhv.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\pqpaahptclt809wxi0l6s_dg.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\te9ud86uzqukkz3ma_xm3_zt.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\y28zqrhfd9dsah9l1fgmk00h.exe' ' (with hidden window)
- '%HOMEPATH%\pictures\minor policy\17w1lgemvximd0l6gehn46vm.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cmd < Film.aspx & ping -n 5 localhost' (with hidden window)
Executes the following
- '<SYSTEM32>\raserver.exe' /offerraupdate
- '%WINDIR%\syswow64\cmd.exe' /c cmd < Film.aspx & ping -n 5 localhost
