Technical Information
To ensure autorun and distribution
Changes the following executable system files
- <SYSTEM32>\comctl32.ocx
- <SYSTEM32>\comdlg32.ocx
- <SYSTEM32>\msinet.ocx
Modifies file system
Creates the following files
- <DRIVERS>\etc\hosts.ics
Deletes the following files
- <DRIVERS>\etc\hosts
Substitutes the HOSTS file.
Network activity
TCP
HTTP GET requests
- http://ci######ongans.blogspot.com/
- http://ma####.bootstrapcdn.com/font-awesome/4.3.0/css/font-awesome.min.css
- http://my.##mark.net/img.gif?f=#############################################
- http://do##hen.com/apu.php?zo############
- http://www.ci####alongan.com/
- http://se###.popads.net/c?_=#####################################################################################################################################################################...
- http://go.##btrks.com/notice.php?p=######################
- http://pu###est.com/ntfc.php?p=#######
- http://www.bl##ger.com/comment-iframe.g?bl###################################################################################
- http://c.##sco.re/
- http://pe#######n-cits.blogspot.com/2015/09/error-file.html
- http://pl######97.puserving.com/0c/eb/c2/0cebc208e531c6b4761e5d1bb6afa0d0.js
- http://www.bl##ger.com/comment-iframe.g?bl############################################################################
- http://3.##.#logspot.com/-3ypydr9U3DI/U9DHOBQy-vI/AAAAAAAAAbs/hvhfDPIpevI/s1600/share.png
- http://do##hen.com/fac.php
- http://4.##.#logspot.com/-JbKcdfpLIpY/VGPWTO9Us7I/AAAAAAAAA9g/WT3xvYm_J28/s1600/btp.png
- http://www.ci####alongan.com/favicon.ico
- http://www.ci####alongan.com/js/cookienotice.js
- http://2.##.#logspot.com/-eXDzvmiaYcc/VktrFQnAsPI/AAAAAAAAGJQ/ECTgSNQKlzs/s1600/siminihome.png
- http://pe#######n-cits.blogspot.com/favicon.ico
- http://pe#######n-cits.blogspot.com/js/cookienotice.js
- http://aj##.#oogleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js
- http://pe#######n-cits.blogspot.com/feeds/posts/default/-/Error%20File?al#########################################################
- http://pe#######n-cits.blogspot.com/2015/09/undefined
- http://c1.##pads.net/pop.js
HTTP POST requests
- http://ad##o.re/t
UDP
- DNS ASK ci######ongans.blogspot.com
- DNS ASK fo###.gstatic.com
- DNS ASK my.##mark.net
- DNS ASK c1.##pads.net
- DNS ASK st#####x.facebook.com
- DNS ASK r2########5e6n7d.googlevideo.com
- DNS ASK accounts.google.com
- DNS ASK go######s.g.doubleclick.net
- DNS ASK s.##img.com
- DNS ASK c.##sco.re
- DNS ASK fa###ook.com
- DNS ASK ad##o.re
- DNS ASK sc#######amt2-1.xx.fbcdn.net
- DNS ASK se###.popads.net
- DNS ASK google.com
- DNS ASK i.##img.com
- DNS ASK 3.##.#logspot.com
- DNS ASK go##le.nl
- DNS ASK co#####.facebook.net
- DNS ASK 4.##.#logspot.com
- DNS ASK yo##u.be
- DNS ASK pe#######n-cits.blogspot.com
- DNS ASK bl##ger.com
- DNS ASK ma####.bootstrapcdn.com
- DNS ASK aj##.#oogleapis.com
- DNS ASK pl######97.puserving.com
- DNS ASK ci####alongan.com
- DNS ASK fi#######torage.googleapis.com
- DNS ASK pu###est.com
- DNS ASK go.##btrks.com
- DNS ASK 2.##.#logspot.com
- DNS ASK fo###.#oogleapis.com
- DNS ASK yo##ube.com
- DNS ASK do##hen.com
- DNS ASK 1.##.#logspot.com
- DNS ASK re#####es.blogblog.com
- DNS ASK yt#.#gpht.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c icacls <DRIVERS>\etc\hosts /reset' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c icacls <DRIVERS>\etc\hosts.ics /reset' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c icacls <DRIVERS>\etc\hosts /reset
- '<SYSTEM32>\cmd.exe' /c icacls <DRIVERS>\etc\hosts.ics /reset
- '%ProgramFiles%\mozilla firefox\firefox.exe' -osint -url "http://ci######ongans.blogspot.com/"
- '%ProgramFiles%\mozilla firefox\firefox.exe' -osint -url "https://youtu.be/uP7NrmhqSNI"
- '%ProgramFiles%\mozilla firefox\firefox.exe' -osint -url "http://pe#######n-cits.blogspot.com/2015/09/error-file.html"