Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d9' = '%APPDATA%\1e6f17d9.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d' = 'C:\1e6f17d9\1e6f17d9.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\1e6f17d9.exe
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
Executes the following:
- '<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet
- '<SYSTEM32>\svchost.exe' netsvcs
- '%WINDIR%\explorer.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system :
Creates the following files:
- %APPDATA%\1e6f17d9.exe
- C:\1e6f17d9\1e6f17d9.exe
Network activity:
Connects to:
- 'ap###ere.com':80
- 'ho#####rsitehere.com':80
- 'as##iag.com':80
- 'od###oup.com':80
- 'ja#####usecleaning.com':80
- 'as####eadedios.org':80
- 'bs###.com.au':80
- 'al##ehr.com':80
- 'co######oni.ording.roma.it':80
- 'ta##fair.fr':80
- 're#####fuochicinesi.it':80
- 'do####esigns.com':80
- 'al#####ofpresence.com':80
- 'bu##ime.by':80
- '40####opping.com':80
- 'as########euneconducteurpascher.fr':80
- 'at#####customwork.com':80
- 'sw#####angzdesserts.com':80
- '7d#.###.myftpupload.com':80
- 'ba###o.spb.ru':80
- 'al###.akesha.com':80
- 'je##rey.fr':80
- '3b###oup.com':80
- 'aw####joinery.co.uk':80
- 'be######ndsekelnerrace.nl':80
- 'al####eshelpt.nl':80
- 'br###game.biz':80
- 'bl####nmedia.com':80
- 'my####rnalip.com':80
- 'ip##ddr.es':80
- 'cu###yip.com':80
- 'am######familyenergy.com':80
- 'go###arro.com':80
- 'up#####ancealbany.com':80
- 'bu###oebers.nl':80
- 'br####riffin.com':80
- '99##b.com':80
- 'be###mor.co.uk':80
- 'an####prundeanu.eu':80
- 'an####tvoyages.com':80
- 'tr######netgourmandises.fr':80
- 'au######choolconsistent.nl':80
- 'am###gan.net':80
- 'be####cznaswinka.pl':80
TCP:
HTTP GET requests:
- http://cu###yip.com/
- http://my####rnalip.com/raw
- http://ip##ddr.es/
HTTP POST requests:
- http://as##iag.com/wp-content/plugins/revslider/temp/update_extract/revslider/img4.php?s=#############
- http://ap###ere.com/wp-content/plugins/revslider/temp/update_extract/revslider/img3.php?b=#############
- http://ja#####usecleaning.com/wp-content/plugins/revslider/temp/update_extract/revslider/img2.php?j=#############
- http://7d#.###.myftpupload.com/wp-content/plugins/revslider/temp/update_extract/revslider/img1.php?u=#############
- http://od###oup.com/wp-content/uploads/wpallimport/uploads/eaff1c028b48519b140086082d15f7a3/img4.php?j=#############
- http://re#####fuochicinesi.it/wp-content/plugins/revslider/temp/update_extract/revslider/img2.php?l=#############
- http://co######oni.ording.roma.it/wp-content/plugins/revslider/temp/update_extract/revslider/img2.php?u=#############
- http://ta##fair.fr/wp-content/uploads/wpallimport/uploads/c93320dc393203a3bdc1a987a3bd1ea7/img4.php?x=#############
- http://ho#####rsitehere.com/wp-content/plugins/revslider/temp/update_extract/revslider/img1.php?v=#############
- http://as####eadedios.org/wp-content/plugins/revslider/temp/update_extract/revslider/img5.php?e=#############
- http://do####esigns.com/wp-content/uploads/wpallimport/uploads/09c62b650c9af5f7a2966b114894cdff/img2.php?e=#############
- http://al#####ofpresence.com/wp-content/plugins/revslider/temp/update_extract/revslider/img4.php?o=#############
- http://bu##ime.by/wp-content/plugins/revslider/temp/update_extract/revslider/img2.php?c=#############
- http://40####opping.com/wp-content/plugins/revslider/temp/update_extract/revslider/img5.php?r=#############
- http://as########euneconducteurpascher.fr/wp-content/uploads/wpallimport/uploads/6826fa428ee44eea2896299a9cdd1391/img1.php?g=#############
- http://ba###o.spb.ru/wp-content/plugins/revslider/temp/update_extract/revslider/img4.php?d=#############
- http://sw#####angzdesserts.com/wp-content/plugins/revslider/temp/update_extract/revslider/img1.php?g=#############
- http://je##rey.fr/wp-content/uploads/wpallimport/uploads/3aa8810fe8a85c3aeaf70245feaf0a41/img3.php?v=#############
- http://at#####customwork.com/wp-content/plugins/revslider/temp/update_extract/revslider/img1.php?x=#############
- http://al###.akesha.com/wp-content/plugins/revslider/temp/update_extract/revslider/img1.php?l=#############
- http://bs###.com.au/wp-content/plugins/revslider/temp/update_extract/revslider/img1.php?z=#############
- http://br###game.biz/wp-content/plugins/revslider/temp/update_extract/revslider/img4.php?l=#############
- http://be######ndsekelnerrace.nl/wp-content/plugins/revslider/temp/update_extract/revslider/img1.php?v=#############
- http://al####eshelpt.nl/wp-content/plugins/revslider/temp/update_extract/revslider/img3.php?j=#############
- http://an####tvoyages.com/wp-content/plugins/revslider/temp/update_extract/revslider/img1.php?s=#############
- http://tr######netgourmandises.fr/wp-content/uploads/wpallimport/uploads/cb899db3b224522e34d4e2ca10788375/img3.php?d=#############
- http://am######familyenergy.com/wp-content/plugins/revslider/temp/update_extract/revslider/img4.php?k=#############
- http://go###arro.com/wp-content/plugins/revslider/temp/update_extract/revslider/img5.php?p=#############
- http://bl####nmedia.com/wp-content/plugins/revslider/temp/update_extract/revslider/img3.php?m=#############
- http://3b###oup.com/wp-content/plugins/revslider/temp/update_extract/revslider/img4.php?r=#############
- http://aw####joinery.co.uk/wp-content/plugins/revslider/temp/update_extract/revslider/img3.php?h=#############
- http://br####riffin.com/wp-content/plugins/revslider/temp/update_extract/revslider/img5.php?o=#############
- http://up#####ancealbany.com/wp-content/plugins/revslider/temp/update_extract/revslider/img5.php?g=#############
- http://be###mor.co.uk/wp-content/plugins/revslider/temp/update_extract/revslider/img5.php?t=#############
- http://al##ehr.com/wp-content/plugins/revslider/temp/update_extract/revslider/img5.php?d=#############
- http://99##b.com/wp-content/plugins/revslider/temp/update_extract/revslider/img3.php?j=#############
- http://be####cznaswinka.pl/wp-content/plugins/revslider/temp/update_extract/revslider/img2.php?f=#############
- http://au######choolconsistent.nl/wp-content/plugins/revslider/temp/update_extract/revslider/img2.php?b=#############
- http://am###gan.net/wp-content/plugins/revslider/temp/update_extract/revslider/img5.php?w=#############
- http://bu###oebers.nl/wp-content/plugins/revslider/temp/update_extract/revslider/img3.php?e=#############
- http://an####prundeanu.eu/wp-content/plugins/revslider/temp/update_extract/revslider/img2.php?d=#############
UDP:
- DNS ASK ap###ere.com
- DNS ASK ho#####rsitehere.com
- DNS ASK as##iag.com
- DNS ASK od###oup.com
- DNS ASK ja#####usecleaning.com
- DNS ASK as####eadedios.org
- DNS ASK bs###.com.au
- DNS ASK al##ehr.com
- DNS ASK co######oni.ording.roma.it
- DNS ASK ta##fair.fr
- DNS ASK re#####fuochicinesi.it
- DNS ASK do####esigns.com
- DNS ASK al#####ofpresence.com
- DNS ASK bu##ime.by
- DNS ASK 40####opping.com
- DNS ASK as########euneconducteurpascher.fr
- DNS ASK at#####customwork.com
- DNS ASK sw#####angzdesserts.com
- DNS ASK 7d#.###.myftpupload.com
- DNS ASK ba###o.spb.ru
- DNS ASK al###.akesha.com
- DNS ASK je##rey.fr
- DNS ASK 3b###oup.com
- DNS ASK aw####joinery.co.uk
- DNS ASK be######ndsekelnerrace.nl
- DNS ASK al####eshelpt.nl
- DNS ASK br###game.biz
- DNS ASK bl####nmedia.com
- DNS ASK my####rnalip.com
- DNS ASK ip##ddr.es
- DNS ASK cu###yip.com
- DNS ASK am######familyenergy.com
- DNS ASK go###arro.com
- DNS ASK up#####ancealbany.com
- DNS ASK bu###oebers.nl
- DNS ASK br####riffin.com
- DNS ASK 99##b.com
- DNS ASK be###mor.co.uk
- DNS ASK an####prundeanu.eu
- DNS ASK an####tvoyages.com
- DNS ASK tr######netgourmandises.fr
- DNS ASK au######choolconsistent.nl
- DNS ASK am###gan.net
- DNS ASK be####cznaswinka.pl
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''