Technical Information
Malicious functions:
Executes the following:
- <SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_SZ /d "http://ge#####dix.blogspot.com" /f
- <SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_SZ /d "http://sh######zara.blogspot.com/" /f
- <SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_SZ /d "http://wa##84.com" /f
- <SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_SZ /d "http://mu#######inimuzik.blogspot.com/" /f
- <SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_SZ /d "http://mi#####.blogspot.com/" /f
- <SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_SZ /d "http://ti#######omputer.blogspot.com/" /f
- <SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_SZ /d "http://www.pa######sen.blogspot.com/" /f
- <SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_SZ /d "http://www.qi###ns87.com" /f
- <SYSTEM32>\msg.exe %USERNAME% /time:10 " ++ 10 KOLEKSI BLOG TERPILIH ++"
- <SYSTEM32>\mode.com 30,5
- <SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_SZ /d "http://an#####ne.blogspot.com" /f
- <SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_SZ /d "http://www.mu######sini.blogspot.com/" /f
- <SYSTEM32>\taskkill.exe /f /im iexplore.exe
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\gedixgedix.blogspot[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\shafaza-zara.blogspot[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\tiptrickcomputer.blogspot[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\muaturunsinimuzik.blogspot[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\mikarot.blogspot[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\wazy84[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\qiilans87[1]
- %TEMP%\bt1252.bat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\muaturunsini.blogspot[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\pakcikhusen.blogspot[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\anonyzone.blogspot[1]
Sets the 'hidden' attribute to the following files:
- %TEMP%\bt1252.bat
Deletes the following files:
- %TEMP%\bt1252.bat
Network activity:
Connects to:
- 'ge#####dix.blogspot.com':80
- 'localhost':1050
- 'localhost':1048
- 'localhost':1046
- 'sh######zara.blogspot.com':80
- 'localhost':1054
- 'mu#######inimuzik.blogspot.com':80
- 'mi#####.blogspot.com':80
- 'ti#######omputer.blogspot.com':80
- 'localhost':1052
- 'www.mu######sini.blogspot.com':80
- 'localhost':1040
- 'localhost':1038
- 'localhost':1035
- 'www.qi###ns87.com':80
- 'localhost':1044
- 'wa##84.com':80
- 'www.pa######sen.blogspot.com':80
- 'an#####ne.blogspot.com':80
- 'localhost':1042
TCP:
HTTP GET requests:
- ge#####dix.blogspot.com/
- sh######zara.blogspot.com/
- ti#######omputer.blogspot.com/
- mu#######inimuzik.blogspot.com/
- mi#####.blogspot.com/
- www.mu######sini.blogspot.com/
- www.qi###ns87.com/
- an#####ne.blogspot.com/
- wa##84.com/
- www.pa######sen.blogspot.com/
UDP:
- DNS ASK ge#####dix.blogspot.com
- DNS ASK sh######zara.blogspot.com
- DNS ASK ti#######omputer.blogspot.com
- DNS ASK mu#######inimuzik.blogspot.com
- DNS ASK mi#####.blogspot.com
- DNS ASK www.mu######sini.blogspot.com
- DNS ASK www.qi###ns87.com
- DNS ASK an#####ne.blogspot.com
- DNS ASK wa##84.com
- DNS ASK www.pa######sen.blogspot.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''