Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\.redbook] 'ImagePath' = '\?'
Malicious functions:
Injects code into
the following system processes:
- <SYSTEM32>\winlogon.exe
- %WINDIR%\Explorer.EXE
Modifies file system :
Creates the following files:
- %WINDIR%\$NtUninstallKB27979$\4121336045\@
- %WINDIR%\$NtUninstallKB27979$\4121336045\cfg.ini
- %WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
- %WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo
Network activity:
Connects to:
- '68.##.115.126':34354
- '69.##8.71.155':34354
- '20#.#4.248.73':34354
- '13#.#0.117.6':34354
- '10#.#28.163.171':34354
- '75.##8.20.202':34354
- '11#.#1.114.209':34354
- '20#.#4.128.241':34354
- '93.##8.89.82':34354
- '19#.#6.200.97':34354
- '20#.#2.170.163':34354
- '20#.#41.197.193':34354
- '68.##.76.213':34354
- '19#.#.159.205':34354
- '66.##1.18.247':34354
- '41.##.135.230':34354
- '18#.#29.192.49':34354
- '10#.#37.41.6':34354
- '18#.#7.137.56':34354
- '67.##.113.180':34354
- '71.#4.23.47':34354
- '17#.#49.82.153':34354
- '41.##4.153.222':34354
- '37.#5.43.76':34354
- '24.##.177.189':34354
- '24.#.212.160':34354
- '76.#08.1.64':34354
- '93.##.218.76':34354
- '67.##7.76.184':34354
- '69.##4.194.254':34354
- '18#.#5.104.218':34354
- '92.#8.10.80':34354
- '17#.#01.231.251':34354
- '11#.#04.9.182':34354
- '78.#30.0.15':34354
- '18#.#4.87.174':34354
- '62.##9.149.231':34354
- '10#.#11.17.245':34354
- '24.##.117.192':34354
- '41.##1.168.99':34354
- '18#.#5.143.171':34354
- '78.##7.34.160':34354
- '90.##4.169.77':34354
- '19#.#0.37.154':34354
- '21#.#9.23.88':34354
- '18#.#80.164.58':34354
- '11#.#19.186.239':34354
- '94.##1.225.8':34354
- '20#.#48.33.67':34354
- '24.##8.133.9':34354
- '24.##.100.111':34354
- '10#.#00.240.139':34354
- '24.##7.86.27':34354
- '18#.#95.231.191':34354
- '94.##6.130.29':34354
- '71.##.56.173':34354
- '74.##.100.211':34354
- '97.##.120.17':34354
- '10#.#3.211.179':34354
- '20#.#5.6.117':34354
- '82.##6.109.28':34354
- '76.##.213.173':34354
- '75.##.238.219':34354
- '92.##5.143.129':34354
- '93.##.122.56':34354
- '66.##8.253.37':34354
- '93.##6.233.64':34354
- '87.##.27.239':34354
- '74.##.64.151':34354
- '95.##1.204.42':34354
- '24.##9.221.195':34354
- '19#.#2.198.147':34354
- '19#.#63.167.179':34354
- '46.##.89.112':34354
- '82.##5.201.186':34354
- '82.##.110.229':34354
- '67.##9.160.133':34354
- '18#.#86.85.106':34354
- '18#.#8.187.63':34354
- '69.##3.153.81':34354
- '18#.#1.167.186':34354
- '78.##.38.128':34354
- '46.##0.241.244':34354
- '11#.#49.82.202':34354
- '98.##.220.241':34354
- '15#.#1.105.246':34354
- '24.##.176.251':34354
- '24.##7.180.184':34354
- '67.##2.110.164':34354
- '24.#.200.185':34354
- '41.##8.46.13':34354
- '18#.#68.64.11':34354
- '11#.#35.92.127':34354
- '24.##.37.218':34354
- '95.##6.133.208':34354
- '71.##7.223.64':34354
- '46.##9.49.11':34354
- '20#.#34.164.28':34354
- '69.##3.70.199':34354
- '19#.#07.99.36':34354
- '10#.#89.214.64':34354
- '20#.#.100.177':34354
- '89.##.151.226':34354
- '59.##0.241.173':34354
- '18#.#4.45.151':34354
- '94.##9.85.135':34354
- '10.##5.77.163':34354
- '20#.#04.190.138':34354
- '31.##3.84.106':34354
- '19#.#00.2.196':34354
- '37.##4.187.26':34354
- '98.##5.138.233':34354
- '2.###.10.199':34354
- '21#.#48.105.12':34354
- '18#.#.64.163':34354
- '19#.#5.235.6':34354
- '24.##0.84.180':34354
- '10#.#4.236.79':34354
- '18#.#45.143.155':34354
- '69.#23.29.6':34354
- '70.##0.74.113':34354
- '67.##1.104.35':34354
- '87.##0.120.204':34354
- '17#.#9.145.29':34354
- '89.##.194.212':34354
- '24.#.57.110':34354
- '87.#.243.13':34354
- '78.#5.38.60':34354
- '79.##0.88.145':34354
- '80.##.151.14':34354
- '95.##1.36.111':34354
- '16#.#6.175.54':34354
- '74.##.149.68':34354
- '24.##.63.120':34354
- '89.##9.150.164':34354
- '24.##8.42.160':34354
- '91.##.68.142':34354
- '95.##.39.150':34354
- '66.##.189.139':34354
- '20#.#11.141.198':34354
- '69.##9.78.232':34354
- '66.##9.172.252':34354
- '21#.#11.67.109':34354
- '78.##.250.79':34354
- '82.#9.213.3':34354
- '97.#5.48.91':34354
- '46.##8.162.9':34354
- '19#.#00.11.225':34354
- '17#.#8.97.90':34354
- '76.##.107.162':34354
- '37.##.227.165':34354
- '69.##0.207.88':34354
- '62.##1.107.207':34354
- '97.##.187.108':34354
- '93.##.15.172':34354
- '18#.74.6.68':34354
- '87.#28.2.73':34354
- '74.##9.5.224':34354
- '79.##6.164.99':34354
- '10#.#85.58.188':34354
- '72.##8.107.67':34354
- '15#.#8.174.226':34354
- '79.##6.37.56':34354
- '81.##2.50.29':34354
- '50.#36.8.81':34354
- '93.##.92.251':34354
- '85.##4.112.29':34354
- '10#.#84.34.27':34354
- '24.##6.12.196':34354
- '67.##2.167.246':34354
- '17#.#08.38.75':34354
- 'pr####.fling.com':80
- '17#.#2.190.142':80
- '17#.#7.137.67':34354
- '24.##4.127.116':34354
- '41.##.136.207':34354
- '17#.#17.171.201':34354
- '65.##.152.160':34354
- '46.##3.152.122':34354
- '11#.#2.137.3':34354
- '80.##.11.118':34354
- '99.##.18.104':34354
- '18#.#15.54.30':34354
- '12#.#01.206.7':34354
- '94.##.76.210':34354
- '18#.#84.15.213':34354
- '86.##7.38.66':34354
- '18#.#0.52.64':34354
- '71.##8.184.36':34354
- '19#.#00.140.112':34354
- '74.##3.91.240':34354
- '72.##8.156.173':34354
- '18#.#0.25.98':34354
- '68.#.220.115':34354
- '18#.#52.73.175':34354
- '90.#53.28.6':34354
- '18#.#0.201.115':34354
- '87.##8.88.155':34354
- '15#.#7.237.98':34354
- '17#.#37.86.114':34354
- '72.##2.243.42':34354
- '78.##9.140.180':34354
- '75.##1.8.167':34354
- '20#.#.252.27':34354
- '67.##4.32.77':34354
- '87.#.250.75':34354
- '10#.#2.216.100':34354
- '10.##5.62.215':34354
- '69.##0.42.222':34354
- '90.##4.14.231':34354
- '99.##3.234.60':34354
- '46.##.121.18':34354
- '37.##.224.148':34354
- '21#.#48.180.68':34354
- '67.##1.41.226':34354
- '24.##.254.97':34354
- '67.##7.25.128':34354
- '92.##.112.247':34354
- '76.##3.112.114':34354
- '74.#0.94.63':34354
- '82.##.178.202':34354
- '76.##6.157.204':34354
- '72.##4.73.16':34354
- '75.##4.253.174':34354
- '71.##5.15.215':34354
- '11#.#3.56.160':34354
- '85.##5.100.254':34354
- '2.##.63.79':34354
- '18#.#4.158.132':34354
- '24.##.125.87':34354
- '92.##5.213.185':34354
- '17#.#02.48.197':34354
- '69.##3.254.46':34354
- '20#.#05.24.154':34354
- '68.##.152.144':34354
- '91.##7.60.22':34354
- '85.##5.151.127':34354
- '98.##6.116.67':34354
- '77.##6.188.170':34354
- '16#.#84.204.41':34354
- '20#.#1.103.91':34354
- '17#.#16.48.245':34354
- '16#.#9.209.248':34354
- '46.##.28.122':34354
- '46.##3.25.213':34354
- '62.##5.192.165':34354
- '20#.7.73.32':34354
- '17#.#8.181.84':34354
- '69.##8.233.63':34354
- '69.##5.142.212':34354
- '13#.#88.203.148':34354
- '14#.#33.36.52':34354
- '13#.#43.249.35':34354
- '69.##8.82.155':34354
- '41.##.213.188':34354
- '17#.#5.226.222':34354
- '92.##0.83.218':34354
- '94.##4.171.197':34354
TCP:
HTTP GET requests:
- 17#.#2.190.142/stat2.php?w=#############################################
- 17#.#2.190.142/stat2.php?w=############################################
- pr####.fling.com/geo/txt/city.php
UDP:
- DNS ASK z#zhK
- DNS ASK z#@�}
- DNS ASK z#�Vl
- DNS ASK z#�1��
- DNS ASK z#��iT
- DNS ASK z#,�N�
- DNS ASK z#ў�
- DNS ASK z##*�
- DNS ASK z#�$z'
- DNS ASK z# ?�F
- DNS ASK pr####.fling.com
- DNS ASK z#M�t
- DNS ASK z#u��
- DNS ASK z#�s̒
- DNS ASK z#�<
- '8.#.8.8':1035