Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'System.Data.Entity' = '"%ProgramFiles%\Reference Assemblies\v3.5\System.Data.Entity.exe"'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\System.Data.Entity.lnk
- %WINDIR%\Tasks\{09EFC5AB-D230-AB81-74D2-4D2309EFC5AB}.job
- %WINDIR%\Tasks\{D2309EFC-AB81-74D2-4D23-1674D2309EFC}.job
Malicious functions:
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'FileMonClass', WindowName: ''
- ClassName: 'RegMonClass', WindowName: ''
- ClassName: 'TCPViewClass', WindowName: ''
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'PROCEXPL', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'SmartSniff', WindowName: ''
Modifies file system:
Creates the following files:
- %ProgramFiles%\Reference Assemblies\v3.5\System.Data.Entity.exe
- C:\System Volume Information\EFS0.LOG
- %APPDATA%\Microsoft\Protect\CREDHIST
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\c313286703754861ee4dfd0d1df36ddc_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %APPDATA%\Microsoft\SystemCertificates\My\Certificates\220C116F3237E0E92B06CD67D8A7FBB8C695089C
- %TEMP%\{D2309EFC-AB81-74D2-4D23-1674D2309EFC}\ZmnkBSPM.exe
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\System.Data.Entity.lnk
- %WINDIR%\Tasks\{09EFC5AB-D230-AB81-74D2-4D2309EFC5AB}.job
- %WINDIR%\Tasks\{D2309EFC-AB81-74D2-4D23-1674D2309EFC}.job
Deletes the following files:
- C:\System Volume Information\EFS0.LOG
Network activity:
Connects to:
- 'an#######oness-misilulety.info':443
- 'ma#######paship-subohukian.info':443
- 'ul#######hern-underaxagocal.net':443
UDP:
- DNS ASK an#######oness-misilulety.info
- DNS ASK mi####usulelike.biz
- DNS ASK ex###nelish.com
- DNS ASK no##########-interulinepish-subalezacal.org
- DNS ASK su#######ian-inokodency.info
- DNS ASK ov####odable.com
- DNS ASK ul####avigoty.net
- DNS ASK ul####adohed.biz
- DNS ASK ov####axovary.biz
- DNS ASK no####mulish.biz
- DNS ASK po###cuzite.com
- DNS ASK de#########subopunitism-irecidolite.org
- DNS ASK an####gamiment.info
- DNS ASK mi#########repugelor-nonogixakity.com
- DNS ASK ma####ikaless.biz
- DNS ASK en###bern.biz
- DNS ASK in####tacanen.biz
- DNS ASK re####saness.org
- DNS ASK im###fing.com
- DNS ASK em###sage.com
- DNS ASK im#######ke-mononimebasion.net
- DNS ASK se###########disegaruless-microrevivudom.com
- DNS ASK un#######nt-emenapatian.info
- DNS ASK mi#######tical-pretegavency.net
- DNS ASK co#####y-irarolify.com
- DNS ASK ex####elike.info
- DNS ASK il#########-misacecian-prevasaward.org
- DNS ASK tr#######ugian-misesaniward.com
- DNS ASK an#########le-emopenakity-unuvizoly.org
- DNS ASK mi####kifage.biz
- DNS ASK mi#######hood-iranavolor.biz
- DNS ASK co###uly.info
- DNS ASK mo####bohood.org
- DNS ASK di#########enapuless-semitahuhate.net
- DNS ASK mi###########microcanoment-ultraxikicihood.biz
- DNS ASK ex###ver.biz
- DNS ASK mi##########overogazeness-interogekate.net
- DNS ASK un######ess-inexekure.net
- DNS ASK re###emive.org
- DNS ASK in########pant-minilobedoship.net
- DNS ASK an########-irukunely-nonohikan.biz
- DNS ASK re###eced.org
- DNS ASK in#######ze-protogecesion.net
- DNS ASK ov####etakion.biz
- DNS ASK in#######r-micropuhiness.biz
- DNS ASK il#######on-monococoxance.biz
- DNS ASK mi#######ard-posterazasance.com
- DNS ASK mi#######sion-ultrahemiman.biz
- DNS ASK em###gely.biz
- DNS ASK il######hip-inegipese.com
- DNS ASK pr#########on-imepogic-emelutation.net
- DNS ASK un########fancy-undericarity.biz
- DNS ASK ma##########n-semififahing-delixazily.net
- DNS ASK ex#######ve-multitifaless.net
- DNS ASK in####gitese.info
- DNS ASK tr########zable-microzemaness.info
- DNS ASK un###########-multilobasous-minilibupadom.com
- DNS ASK ov###########inikazabish-ultranoduniment.net
- DNS ASK em##########microtorahian-multikimofing.com
- DNS ASK un###########n-postetepilike-overekenous.biz
- DNS ASK mo###########n-macroluzalelike-inuculist.biz
- DNS ASK mu####iredom.net
- DNS ASK ir#########ntikidafion-antikebugian.org
- DNS ASK im######-minipelalive.org
- DNS ASK no####vovure.biz
- DNS ASK mi##########inilivilike-disebaputive.biz
- DNS ASK ma###farath.org
- DNS ASK su#########al-regehuhaly-unemesian.info
- DNS ASK ex###hor.info
- DNS ASK ul#######hern-underaxagocal.net
- DNS ASK ma#######paship-subohukian.info
- DNS ASK tr#######ety-macrotafapism.org
- DNS ASK im#########lokotity-multidicebity.com
- DNS ASK di####revous.info
- DNS ASK di##########nonehatusion-minimexeness.com
- DNS ASK no###ision.biz
- DNS ASK mi#######iment-inilatuzity.biz
- DNS ASK no##########underirelancy-unasocigency.org
- DNS ASK mu#######cance-inogixulency.net
- DNS ASK un###########-subagozaless-multivazoping.biz
- DNS ASK ma#######bage-ineruxish.info
- DNS ASK ma######anite-imugivian.biz
- DNS ASK il#########-misozozosion-nonenufize.biz
- DNS ASK mi##########verofobision-semilobossion.info
- DNS ASK re###eted.net
- DNS ASK se####somity.net
- DNS ASK im##########-retilelike-macrofocuked.org
- DNS ASK im###sidom.org
- DNS ASK an###########transisivulike-underefirize.org
- DNS ASK un######biding-unesomer.biz
- DNS ASK ir######ul-pretodicafy.org
- DNS ASK im###vitic.info
- DNS ASK no######on-overozecaful.com
- DNS ASK em#####re-exirovage.com
- DNS ASK su##########ltraduhidith-underulegitese.biz
- DNS ASK co##########bibifoment-semitapofulike.net
- DNS ASK un###ziward.net
- DNS ASK en#########roruvikify-subibonetion.info
- DNS ASK di######less-defopadom.net
- DNS ASK en###tent.biz
Miscellaneous:
Searches for the following windows:
- ClassName: 'WinDbgFrameClass' WindowName: ''
- ClassName: 'PacketSnifferClass1' WindowName: ''
- ClassName: 'dbgviewClass' WindowName: ''
- ClassName: 'pediy0' WindowName: ''
- ClassName: 'cwmonitor' WindowName: ''
- ClassName: '' WindowName: ''
Executes the following:
- '<SYSTEM32>\svchost.exe'