Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'xmkkxnh' = '<LS_APPDATA>\wavbgw.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\unmst.exe
Malicious functions:
Injects code into
the following system processes:
- %WINDIR%\Explorer.EXE
the following user processes:
- skype.exe
Modifies file system :
Creates the following files:
- <LS_APPDATA>\wavbgw.exe
Sets the 'hidden' attribute to the following files:
- <LS_APPDATA>\wavbgw.exe
- %HOMEPATH%\Start Menu\Programs\Startup\unmst.exe
Network activity:
Connects to:
- '9.###.144.56':80
- '9.###.144.54':80
TCP:
HTTP POST requests:
- 9.###.144.56/query.php
- 9.###.144.54/query.php
UDP:
- DNS ASK sn##to.net
- DNS ASK it.st
- DNS ASK ne###unce.net
- DNS ASK di##ct.net
- DNS ASK fr.vu
- DNS ASK ge##o.net
- DNS ASK be.tf
- DNS ASK sp.st
- DNS ASK on###dress.net
- DNS ASK bs##fan.com
- DNS ASK mp#.ms
- DNS ASK su##se.st
- DNS ASK en.st
- DNS ASK fr.st
- DNS ASK in###ames.com
- DNS ASK em##lme.net
- DNS ASK ja###fan.com
- DNS ASK in#.ms
- DNS ASK cl#n.st
- DNS ASK ht.st
- DNS ASK li###ala.com
- DNS ASK vd##ect.com
- DNS ASK ti###url.com
- DNS ASK qc.tc
- DNS ASK ma##fan.com
- DNS ASK ca.tc
- DNS ASK fr.fm
- DNS ASK un###over.com
- DNS ASK c0#.st
- DNS ASK gr.st
- DNS ASK ul##it.com
- DNS ASK li###-fan.com
- DNS ASK we###lly.net
- DNS ASK t2#.com
- DNS ASK be#t.cd
- DNS ASK ne###unce.com
- DNS ASK eu#o.st
- DNS ASK co##2.com
- DNS ASK zi#.mu
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
