Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt] 'DLLName' = 'crypts.dll'
Malicious functions:
Injects code into
the following system processes:
- %WINDIR%\Explorer.EXE
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[15].php
- %TEMP%\91D1.tmp
- %TEMP%\97EC.tmp
- %TEMP%\9DF6.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[15].php
- %TEMP%\855E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[14].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[14].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[14].php
- %TEMP%\8BA7.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[15].php
- %TEMP%\B6ED.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[16].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[16].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[16].php
- %TEMP%\BD08.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[15].php
- %TEMP%\A45F.tmp
- %TEMP%\AA6A.tmp
- %TEMP%\B084.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[16].php
- %TEMP%\517C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[12].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[12].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[12].php
- %TEMP%\5768.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[11].php
- %TEMP%\3F1D.tmp
- %TEMP%\4557.tmp
- %TEMP%\4B71.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[12].php
- %TEMP%\5D63.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[13].php
- %TEMP%\7272.tmp
- %TEMP%\786D.tmp
- %TEMP%\7EA7.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[14].php
- %TEMP%\637E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[13].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[13].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[13].php
- %TEMP%\6B8C.tmp
- %TEMP%\C332.tmp
- %TEMP%\1922.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[20].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[20].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[20].php
- %TEMP%\1F5B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[19].php
- %TEMP%\684.tmp
- %TEMP%\CAE.tmp
- %TEMP%\12D8.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[20].php
- %TEMP%\2FE6.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[21].php
- %TEMP%\4CD4.tmp
- %TEMP%\5ADE.tmp
- %TEMP%\701B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[22].php
- %TEMP%\3823.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[21].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[21].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[21].php
- %TEMP%\4022.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[17].php
- %TEMP%\D5EF.tmp
- %TEMP%\DBF9.tmp
- %TEMP%\E1F5.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[18].php
- %TEMP%\C91D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[17].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[17].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[17].php
- %TEMP%\CF57.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[18].php
- %TEMP%\FA3F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[19].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[19].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[19].php
- %TEMP%\89.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[18].php
- %TEMP%\E80F.tmp
- %TEMP%\EE1A.tmp
- %TEMP%\F435.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[18].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[11].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[4].php
- %TEMP%\7516.tmp
- %TEMP%\7B21.tmp
- %TEMP%\819A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[4].php
- %TEMP%\6651.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[3].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[3].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[4].php
- %TEMP%\6C9B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[4].php
- %TEMP%\9A61.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[5].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[5].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[6].php
- %TEMP%\A03D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[5].php
- %TEMP%\8766.tmp
- %TEMP%\8D23.tmp
- %TEMP%\9456.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[5].php
- %TEMP%\31F3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[2].php
- %TEMP%\37EE.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[1].php
- <SYSTEM32>\crypts.dll
- %TEMP%\1E6B.tmp
- %TEMP%\29A6.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[1].php
- %TEMP%\3EE3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[3].php
- %TEMP%\50F4.tmp
- %TEMP%\56E0.tmp
- %TEMP%\6075.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[3].php
- %TEMP%\455C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[2].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[2].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[2].php
- %TEMP%\4B57.tmp
- %TEMP%\A639.tmp
- %TEMP%\30E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[9].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[9].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[10].php
- %TEMP%\986.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[9].php
- %TEMP%\ED44.tmp
- %TEMP%\F41A.tmp
- %TEMP%\FC96.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[9].php
- %TEMP%\FB1.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[11].php
- %TEMP%\2B95.tmp
- %TEMP%\324C.tmp
- %TEMP%\3912.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[11].php
- %TEMP%\1687.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[10].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[10].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[10].php
- %TEMP%\1FBE.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[7].php
- %TEMP%\B8C7.tmp
- %TEMP%\C114.tmp
- %TEMP%\C7AB.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[7].php
- %TEMP%\AC05.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[6].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[6].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[6].php
- %TEMP%\B25E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[7].php
- %TEMP%\E0F0.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[8].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[8].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[8].php
- %TEMP%\E739.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[7].php
- %TEMP%\CD87.tmp
- %TEMP%\D44D.tmp
- %TEMP%\DAE5.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[8].php
Deletes the following files:
- %TEMP%\9DF6.tmp
- %TEMP%\A45F.tmp
- %TEMP%\97EC.tmp
- %TEMP%\8BA7.tmp
- %TEMP%\91D1.tmp
- %TEMP%\BD08.tmp
- %TEMP%\C332.tmp
- %TEMP%\B6ED.tmp
- %TEMP%\AA6A.tmp
- %TEMP%\B084.tmp
- %TEMP%\855E.tmp
- %TEMP%\5768.tmp
- %TEMP%\5D63.tmp
- %TEMP%\517C.tmp
- %TEMP%\4557.tmp
- %TEMP%\4B71.tmp
- %TEMP%\786D.tmp
- %TEMP%\7EA7.tmp
- %TEMP%\7272.tmp
- %TEMP%\637E.tmp
- %TEMP%\6B8C.tmp
- %TEMP%\1F5B.tmp
- %TEMP%\2FE6.tmp
- %TEMP%\1922.tmp
- %TEMP%\CAE.tmp
- %TEMP%\12D8.tmp
- %TEMP%\5ADE.tmp
- %TEMP%\701B.tmp
- %TEMP%\4CD4.tmp
- %TEMP%\3823.tmp
- %TEMP%\4022.tmp
- %TEMP%\684.tmp
- %TEMP%\DBF9.tmp
- %TEMP%\E1F5.tmp
- %TEMP%\D5EF.tmp
- %TEMP%\C91D.tmp
- %TEMP%\CF57.tmp
- %TEMP%\FA3F.tmp
- %TEMP%\89.tmp
- %TEMP%\F435.tmp
- %TEMP%\E80F.tmp
- %TEMP%\EE1A.tmp
- %TEMP%\3F1D.tmp
- %TEMP%\819A.tmp
- %TEMP%\8766.tmp
- %TEMP%\7B21.tmp
- %TEMP%\6C9B.tmp
- %TEMP%\7516.tmp
- %TEMP%\A03D.tmp
- %TEMP%\A639.tmp
- %TEMP%\9A61.tmp
- %TEMP%\8D23.tmp
- %TEMP%\9456.tmp
- %TEMP%\6651.tmp
- %TEMP%\37EE.tmp
- %TEMP%\3EE3.tmp
- %TEMP%\31F3.tmp
- %TEMP%\1E6B.tmp
- %TEMP%\29A6.tmp
- %TEMP%\56E0.tmp
- %TEMP%\6075.tmp
- %TEMP%\50F4.tmp
- %TEMP%\455C.tmp
- %TEMP%\4B57.tmp
- %TEMP%\986.tmp
- %TEMP%\FB1.tmp
- %TEMP%\30E.tmp
- %TEMP%\F41A.tmp
- %TEMP%\FC96.tmp
- %TEMP%\324C.tmp
- %TEMP%\3912.tmp
- %TEMP%\2B95.tmp
- %TEMP%\1687.tmp
- %TEMP%\1FBE.tmp
- %TEMP%\ED44.tmp
- %TEMP%\C114.tmp
- %TEMP%\C7AB.tmp
- %TEMP%\B8C7.tmp
- %TEMP%\AC05.tmp
- %TEMP%\B25E.tmp
- %TEMP%\E0F0.tmp
- %TEMP%\E739.tmp
- %TEMP%\DAE5.tmp
- %TEMP%\CD87.tmp
- %TEMP%\D44D.tmp
Network activity:
Connects to:
- 'it###rying.com':80
- 'li####soring.com':80
- 'localhost':1036
TCP:
HTTP GET requests:
- it###rying.com/bt.php?mo###############################################
- li####soring.com/bt.php?mo###############################################
UDP:
- DNS ASK it###rying.com
- DNS ASK li####soring.com