Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'CryptoLocker' = '%APPDATA%\Roaming\{251D6684-2103-0713-3D1A-143F3922242B}.exe'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\Roaming\{251D6684-2103-0713-3D1A-143F3922242B}.exe' /w000000A0
- '%APPDATA%\Roaming\{251D6684-2103-0713-3D1A-143F3922242B}.exe' "/r<Full path to virus>"
Modifies file system :
Creates the following files:
- %APPDATA%\Roaming\{251D6684-2103-0713-3D1A-143F3922242B}.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\Roaming\{251D6684-2103-0713-3D1A-143F3922242B}.exe
Deletes itself.
Network activity:
Connects to:
- 'bu####paxxqle.com':80
- 'pu####yctiehl.net':80
- 'dy####dbrjetl.biz':80
- 'nq####lbawqyn.info':80
- 'kp####gfielst.ru':80
- 'kb####egrydjl.org':80
- 'lq####ttevvvk.co.uk':80
- 'vj####jqxrrlc.com':80
- 'wy####pkvuopb.net':80
- 'xn####wrrdfta.biz':80
- 'fo####evypqqe.info':80
- 'pg####mvhddvn.ru':80
- 'dk####qufedie.org':80
- 'rk####awboqee.co.uk':80
- 'ja####qrvhsgl.biz':80
- 'as####fhmxlip.info':80
- 'nw####sdyspmg.com':80
- 'bh####snxmnci.net':80
- 'mv####fodbfji.co.uk':80
- 'ny####tgybupn.biz':80
- 'oo####aawertv.ru':80
- 'yr####rsqgbfi.org':80
- 'ia####fkbxyvi.info':80
- 'il####dlksqmh.com':80
- 'jb####sywpjyg.net':80
- 'hk####pwobgja.co.uk':80
- 'ol####gjkhrgi.biz':80
- 'ci####gctexfi.ru':80
- 'pm####txgycjy.org':80
- 'yd####dlpgcxi.ru':80
- 'ie###byrxdbi.ru':80
- 'vq####rvppxb.org':80
- 'we####hbdqno.co.uk':80
- 'uc####lekmnm.biz':80
- 'go####iguwac.info':80
- 'tb####krvjql.com':80
- 'hd####xfjaeh.net':80
- 'yh###ijthyvi.ru':80
- 'au####yyualv.org':80
- 'gt####vhkntr.co.uk':80
- 'yt####xmgwou.biz':80
- 'wr####siesuc.info':80
- 'xf####inrtkp.com':80
- 'xg####ihsvyh.net':80
- 'sm####ushgmg.co.uk':80
- 'lq####inxfdsn.net':80
- 'ys####vjhkobn.biz':80
- 'mr####dowokfn.ru':80
- 'bs####egwmoum.com':80
- 'xy####klfxein.org':80
- 'yo####qfdbbmm.co.uk':80
- 'ad####xmyjrqe.info':80
- 'du####lyakcu.biz':80
- 'rl###itgsdpf.ru':80
- 'fn####htgtdb.org':80
- 'ch####fwddwy.net':80
- 'at####qkgtvne.org':80
- 'pa####xifrqxr.co.uk':80
- 'bq####dmhfhp.com':80
- 'qv####mujgkig.org':80
- 'ex####qinkseg.co.uk':80
- 'qd####cbqxoph.info':80
- 'cp####dhyvang.ru':80
- 'og####umguekc.com':80
- 'ci####yakymgc.net':80
- 'on####yturrrp.biz':80
- 'tg####aoxbpbg.org':80
- 'ub####hkixnex.co.uk':80
- 'vo####npmpirg.info':80
- 'ss####tjtjunh.ru':80
- 'rq####igupjdg.com':80
- 'sl####pcfmhgf.net':80
- 'ty####vhjectn.biz':80
- 'aa####lyvktpu.info':80
- 'wg####xxossnc.ru':80
- 'ko####augiwua.org':80
- 'lc####pwtgnqi.co.uk':80
- 'je####kqbigal.biz':80
- '18#.#64.136.134':80
- 'iy####wckcvfl.com':80
- 'vb####kjxmisl.net':80
- 'nj####fraanna.ru':80
- 'ow####utnxejy.org':80
- 'mx####hlrglte.co.uk':80
- 'nr####hfwrtoi.biz':80
- 'lt####njwohph.info':80
- 'mh####dlkmxlg.com':80
- 'me####rdjtdsa.net':80
- 'kt####eejyjsh.com':80
- 'dc####bjehdep.info':80
- 'qg####ficidqg.com':80
- 'fg####vqbgtdn.net':80
- 'ob####wvnrmjn.co.uk':80
- 'ys####xpsrvxw.biz':80
- 'mw####coqsvkn.ru':80
- 'bw####swpqmwn.org':80
- 'kf####wgloknk.info':80
- 'lu####yycceqp.com':80
- 'mk####fsafbuo.net':80
- 'jp####qmnlnjc.co.uk':80
- 'sk####apyhtpn.biz':80
- 'hl####vfqmwkl.ru':80
- 'ib####cyoptok.org':80
- 'ym####pqepvcj.net':80
- 'ch####uthjuda.co.uk':80
- 'pe####cytxxlh.info':80
- 'di####pugscpx.com':80
- 'od####hxuoqya.org':80
- 'xx####ravtnwh.net':80
- 'lu####yfiiqfh.biz':80
- 'yy####mbudujx.ru':80
- 'wv####fcsjvdd.co.uk':80
- 'xl####upfgopl.info':80
- 'xw####adrsdpk.com':80
- 'ud####mwsaovx.org':80
- 'sm####cihtowy.net':80
- 'tc####rvtqhjh.biz':80
- 'tn####wjgdvjy.ru':80
UDP:
- DNS ASK pu####yctiehl.net
- DNS ASK dy####dbrjetl.biz
- DNS ASK pg####mvhddvn.ru
- DNS ASK bu####paxxqle.com
- DNS ASK kb####egrydjl.org
- DNS ASK lq####ttevvvk.co.uk
- DNS ASK nq####lbawqyn.info
- DNS ASK wy####pkvuopb.net
- DNS ASK xn####wrrdfta.biz
- DNS ASK yd####dlpgcxi.ru
- DNS ASK vj####jqxrrlc.com
- DNS ASK dk####qufedie.org
- DNS ASK rk####awboqee.co.uk
- DNS ASK fo####evypqqe.info
- DNS ASK kp####gfielst.ru
- DNS ASK nw####sdyspmg.com
- DNS ASK bh####snxmnci.net
- DNS ASK ol####gjkhrgi.biz
- DNS ASK as####fhmxlip.info
- DNS ASK oo####aawertv.ru
- DNS ASK yr####rsqgbfi.org
- DNS ASK mv####fodbfji.co.uk
- DNS ASK il####dlksqmh.com
- DNS ASK jb####sywpjyg.net
- DNS ASK ja####qrvhsgl.biz
- DNS ASK ia####fkbxyvi.info
- DNS ASK ci####gctexfi.ru
- DNS ASK pm####txgycjy.org
- DNS ASK hk####pwobgja.co.uk
- DNS ASK ie###byrxdbi.ru
- DNS ASK vq####rvppxb.org
- DNS ASK we####hbdqno.co.uk
- DNS ASK uc####lekmnm.biz
- DNS ASK go####iguwac.info
- DNS ASK tb####krvjql.com
- DNS ASK hd####xfjaeh.net
- DNS ASK yh###ijthyvi.ru
- DNS ASK au####yyualv.org
- DNS ASK gt####vhkntr.co.uk
- DNS ASK yt####xmgwou.biz
- DNS ASK wr####siesuc.info
- DNS ASK xf####inrtkp.com
- DNS ASK xg####ihsvyh.net
- DNS ASK sm####ushgmg.co.uk
- DNS ASK lq####inxfdsn.net
- DNS ASK ys####vjhkobn.biz
- DNS ASK mr####dowokfn.ru
- DNS ASK bs####egwmoum.com
- DNS ASK xy####klfxein.org
- DNS ASK yo####qfdbbmm.co.uk
- DNS ASK ad####xmyjrqe.info
- DNS ASK du####lyakcu.biz
- DNS ASK rl###itgsdpf.ru
- DNS ASK fn####htgtdb.org
- DNS ASK ch####fwddwy.net
- DNS ASK at####qkgtvne.org
- DNS ASK pa####xifrqxr.co.uk
- DNS ASK bq####dmhfhp.com
- DNS ASK ny####tgybupn.biz
- DNS ASK ex####qinkseg.co.uk
- DNS ASK qd####cbqxoph.info
- DNS ASK rq####igupjdg.com
- DNS ASK qv####mujgkig.org
- DNS ASK ci####yakymgc.net
- DNS ASK on####yturrrp.biz
- DNS ASK cp####dhyvang.ru
- DNS ASK ub####hkixnex.co.uk
- DNS ASK vo####npmpirg.info
- DNS ASK kt####eejyjsh.com
- DNS ASK tg####aoxbpbg.org
- DNS ASK sl####pcfmhgf.net
- DNS ASK ty####vhjectn.biz
- DNS ASK ss####tjtjunh.ru
- DNS ASK og####umguekc.com
- DNS ASK ko####augiwua.org
- DNS ASK lc####pwtgnqi.co.uk
- DNS ASK lt####njwohph.info
- DNS ASK wg####xxossnc.ru
- DNS ASK iy####wckcvfl.com
- DNS ASK vb####kjxmisl.net
- DNS ASK je####kqbigal.biz
- DNS ASK ow####utnxejy.org
- DNS ASK mx####hlrglte.co.uk
- DNS ASK aa####lyvktpu.info
- DNS ASK nj####fraanna.ru
- DNS ASK mh####dlkmxlg.com
- DNS ASK me####rdjtdsa.net
- DNS ASK nr####hfwrtoi.biz
- DNS ASK dc####bjehdep.info
- DNS ASK qg####ficidqg.com
- DNS ASK fg####vqbgtdn.net
- DNS ASK ob####wvnrmjn.co.uk
- DNS ASK ys####xpsrvxw.biz
- DNS ASK mw####coqsvkn.ru
- DNS ASK bw####swpqmwn.org
- DNS ASK kf####wgloknk.info
- DNS ASK lu####yycceqp.com
- DNS ASK mk####fsafbuo.net
- DNS ASK jp####qmnlnjc.co.uk
- DNS ASK sk####apyhtpn.biz
- DNS ASK hl####vfqmwkl.ru
- DNS ASK ib####cyoptok.org
- DNS ASK ym####pqepvcj.net
- DNS ASK ch####uthjuda.co.uk
- DNS ASK pe####cytxxlh.info
- DNS ASK di####pugscpx.com
- DNS ASK od####hxuoqya.org
- DNS ASK xx####ravtnwh.net
- DNS ASK lu####yfiiqfh.biz
- DNS ASK yy####mbudujx.ru
- DNS ASK wv####fcsjvdd.co.uk
- DNS ASK xl####upfgopl.info
- DNS ASK xw####adrsdpk.com
- DNS ASK ud####mwsaovx.org
- DNS ASK sm####cihtowy.net
- DNS ASK tc####rvtqhjh.biz
- DNS ASK tn####wjgdvjy.ru
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: '(null)'