Technical Information
Malicious functions:
Searches for windows to
detect analytical utilities:
- ClassName: '(null)' WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'GBDYLLO' WindowName: '(null)'
- ClassName: 'OLLYDBG' WindowName: '(null)'
- ClassName: 'FilemonClass' WindowName: '(null)'
- ClassName: 'pediy06' WindowName: '(null)'
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = '127.0.0.1:9666'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '127.0.0.1'
- [<HKLM>\SYSTEM\ControlSet001\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1C00' = '{00,00,00,00}'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'CurrentLevel' = '{00,00,00,00}'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
Modifies file system :
Creates the following files:
- <Current directory>\utmp\~pdddzhthltx0u4j
- <Current directory>\utmp\~fecqejjrjji0t1a
- <Current directory>\utmp\~hjnkfdildii9h9f
Network activity:
Connects to:
- '21#.#63.17.42':443
- '12#.#30.14.4':443
- '65.#9.2.21':443
- '65.#9.2.24':443
- '65.#9.2.13':443
- '21#.#65.24.161':443
- '65.#9.2.14':443
- '65.#9.14.13':443
- '99.#7.99.36':443
- '17#.#80.215.100':443
- '22#.#42.178.110':443
- '12#.#25.3.57':443
- '21#.#4.110.97':443
- '16#.#1.84.22':443
- '20#.#15.239.38':443
- '17#.#80.185.84':443
- '20#.#6.181.191':443
- '11#.#28.10.116':443
- '21#.#60.109.6':443
- '21#.#71.128.97':443
- '20#.#5.38.32':443
- '20#.#21.141.69':443
- '11#.#5.182.57':443
UDP:
- DNS ASK go##le.mu
- DNS ASK go##gle.com
- DNS ASK ge##le.com
- DNS ASK go###e.com.ph
- DNS ASK go###e.co.in
- DNS ASK tl##.#qvdgj.info
- DNS ASK ua#.#qvdgj.info
- DNS ASK go###e.co.ck
- DNS ASK dw##.#qvdgj.info
- DNS ASK pb###.wqvdgj.info
- DNS ASK go##le.kz
- DNS ASK go##le.ca
- DNS ASK 46##53.com
- DNS ASK ww###ogle.com
- DNS ASK yr#.#qvdgj.info
- DNS ASK ek.##vdgj.info
- DNS ASK rn##.#qvdgj.info
- DNS ASK jj####.wqvdgj.info
- DNS ASK lz###.wqvdgj.info
- DNS ASK www.he##z.com
- DNS ASK tp####.wqvdgj.info
- DNS ASK go###e.com.my
- DNS ASK im####t.wqvdgj.info
- DNS ASK ao#.#qvdgj.info
- DNS ASK vp#.#qvdgj.info
- DNS ASK wi####x.wqvdgj.info
- DNS ASK bi#####.iyoyo.com.cn
- DNS ASK ib###.wqvdgj.info
- DNS ASK go##le.lv
- DNS ASK sa###.wqvdgj.info
- DNS ASK go###ecom.com
- DNS ASK ha##.#qvdgj.info
- DNS ASK le.##vdgj.info
- DNS ASK go##le.pt
- DNS ASK go##le.ro
- DNS ASK de####per.skype.com
- DNS ASK s3.###zonaws.com
- DNS ASK go##le.dk
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '18467-41' WindowName: '(null)'