Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'CryptoLocker' = '"%APPDATA%\{F2044B43-EB9D-E0C9-83C2-EBCBF7C6A9EE}.exe"'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\{F2044B43-EB9D-E0C9-83C2-EBCBF7C6A9EE}.exe' /w0000007C
- '%APPDATA%\{F2044B43-EB9D-E0C9-83C2-EBCBF7C6A9EE}.exe' "/r<Full path to virus>"
Modifies file system :
Creates the following files:
- %TEMP%\KOJF868.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\home[1].htm
- %TEMP%\PNQ9E38.tmp
- %TEMP%\NIPD397.tmp
- %APPDATA%\{F2044B43-EB9D-E0C9-83C2-EBCBF7C6A9EE}.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\{F2044B43-EB9D-E0C9-83C2-EBCBF7C6A9EE}.exe
Deletes the following files:
- %TEMP%\KOJF868.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\home[1].htm
- %TEMP%\NIPD397.tmp
- %TEMP%\PNQ9E38.tmp
Deletes itself.
Network activity:
Connects to:
- 'oo#####bnecludo.info':80
- 'ne#####vfgetunl.co.uk':80
- 'pa####yltqywuil.com':80
- 'rm####jhrndrcur.biz':80
- 'qk####mqcowoekw.net':80
- 'yw####fggwqsvqo.org':80
- 'uo####iutpruhjo.com':80
- 'hs#####hlufhgul.info':80
- 'jf####ddjrjccyq.net':80
- 'lb####psxcefujp.ru':80
- 'wb####sqrmvptwx.biz':80
- 'sw####wmalbjcdq.ru':80
- 'ib####xtbfmkktt.org':80
- 'ud####rxiblxjnp.ru':80
- 'vx#####nhvnwswn.co.uk':80
- 'wv####stbqpcjtp.com':80
- 'jv#####jaaojkta.info':80
- 'ht####umxodddmt.biz':80
- 'us#####covvmelp.co.uk':80
- 'ti####vwgxxuuqi.org':80
- 'sb#####bgparjmw.info':80
- 'tv####oqfkcqlwl.net':80
- 'gy####pwytbeklw.com':80
- 'ss#####fffwrxqo.co.uk':80
- 'er####mjryxtslb.ru':80
- 'qv####gckyhcrqo.biz':80
- 'ru####sfwtikbun.org':80
- 'ue#####nwgganbs.info':80
- 'fq#####metycsdr.co.uk':80
- 'ph####ojqmbbwjw.net':80
- 'nf####plirivpgw.org':80
- 'mu####cgatkegel.ru':80
- 'mb#####inrawngb.co.uk':80
- 'ow####beiodjnop.com':80
- 'nl#####nvpxonoa.info':80
- 'ia####juegwroob.com':80
- 'ev####nfmfxhaig.net':80
- 'dl####jdfcetqkg.com':80
- 'ek####vgrwfcshg.biz':80
- 'fw####grwkkegld.org':80
- 'fu####aiyaypsvo.ru':80
- 'bm#####wmsarsrm.info':80
- 'jy####vxqbxahnb.biz':80
- 'vd####pqjbhipmb.net':80
- 'yd####mrsufvjgj.ru':80
- 'ac#####ufpgesva.co.uk':80
- 'an####qtaxyjsln.org':80
UDP:
- DNS ASK oo#####bnecludo.info
- DNS ASK ne#####vfgetunl.co.uk
- DNS ASK pa####yltqywuil.com
- DNS ASK rm####jhrndrcur.biz
- DNS ASK qk####mqcowoekw.net
- DNS ASK yw####fggwqsvqo.org
- DNS ASK uo####iutpruhjo.com
- DNS ASK hs#####hlufhgul.info
- DNS ASK jf####ddjrjccyq.net
- DNS ASK lb####psxcefujp.ru
- DNS ASK wb####sqrmvptwx.biz
- DNS ASK sw####wmalbjcdq.ru
- DNS ASK ib####xtbfmkktt.org
- DNS ASK ud####rxiblxjnp.ru
- DNS ASK vx#####nhvnwswn.co.uk
- DNS ASK wv####stbqpcjtp.com
- DNS ASK jv#####jaaojkta.info
- DNS ASK ht####umxodddmt.biz
- DNS ASK us#####covvmelp.co.uk
- DNS ASK ti####vwgxxuuqi.org
- DNS ASK sb#####bgparjmw.info
- DNS ASK tv####oqfkcqlwl.net
- DNS ASK gy####pwytbeklw.com
- DNS ASK ss#####fffwrxqo.co.uk
- DNS ASK er####mjryxtslb.ru
- DNS ASK qv####gckyhcrqo.biz
- DNS ASK ru####sfwtikbun.org
- DNS ASK ue#####nwgganbs.info
- DNS ASK fq#####metycsdr.co.uk
- DNS ASK ph####ojqmbbwjw.net
- DNS ASK nf####plirivpgw.org
- DNS ASK mu####cgatkegel.ru
- DNS ASK mb#####inrawngb.co.uk
- DNS ASK ow####beiodjnop.com
- DNS ASK nl#####nvpxonoa.info
- DNS ASK ia####juegwroob.com
- DNS ASK ev####nfmfxhaig.net
- DNS ASK dl####jdfcetqkg.com
- DNS ASK ek####vgrwfcshg.biz
- DNS ASK fw####grwkkegld.org
- DNS ASK fu####aiyaypsvo.ru
- DNS ASK bm#####wmsarsrm.info
- DNS ASK jy####vxqbxahnb.biz
- DNS ASK vd####pqjbhipmb.net
- DNS ASK yd####mrsufvjgj.ru
- DNS ASK ac#####ufpgesva.co.uk
- DNS ASK an####qtaxyjsln.org
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: '(null)'
