Technical Information
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\uTorrent\uTorrent.exe' = '%PROGRAM_FILES%\uTorrent\uTorrent.exe:*:Enabled:μTorrent'
Creates and executes the following:
- '%PROGRAM_FILES%\uTorrent\uTorrent.exe' /NOINSTALL
Modifies file system :
Creates the following files:
- %APPDATA%\uTorrent\updates.dat
- %APPDATA%\uTorrent\ie\ie.1423777346.tmp
- %APPDATA%\uTorrent\ie\ie.1423777341.tmp
- %HOMEPATH%\Cookies\%USERNAME%@localhost[1].txt
- %APPDATA%\uTorrent\settings.dat.new
- <LS_APPDATA>\Microsoft\Internet Explorer\MSIMGSIZ.DAT
- %HOMEPATH%\Cookies\%USERNAME%@localhost[2].txt
- %APPDATA%\uTorrent\apps\plus.btapp
- %APPDATA%\uTorrent\ie\ie.1423777347.tmp
- %APPDATA%\uTorrent\maindoc.ico
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\1f91d2d17ea675d4c2c3192e241743f9_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %TEMP%\utt1.tmp.new
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %HOMEPATH%\Start Menu\Programs\Utorrent\Utorrent .lnk
- %PROGRAM_FILES%\uTorrent\uTorrent.exe
- %HOMEPATH%\Desktop\Utorrent.lnk
- %TEMP%\Cab2.tmp
- %APPDATA%\Microsoft\Protect\CREDHIST
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Deletes the following files:
- %HOMEPATH%\Cookies\%USERNAME%@localhost[1].txt
- %TEMP%\utt1.tmp
- %TEMP%\Cab2.tmp
Moves the following files:
- from %APPDATA%\uTorrent\settings.dat.new to %APPDATA%\uTorrent\settings.dat
- from %TEMP%\utt1.tmp.new to %TEMP%\utt1.tmp
Network activity:
Connects to:
- 'cd#.###medianetwork.com':80
- 'be###.utorrent.com':80
- 'up####.bittorrent.com':80
- 'up####.utorrent.com':80
- 'up####.utorrent.li':80
- 'www.download.windowsupdate.com':80
- 'wp#d':80
- 'ut#####t.utorrent.com':80
- 'localhost':15589
- 'localhost':1043
TCP:
HTTP GET requests:
- up####.bittorrent.com/time.php
- cd#.###medianetwork.com/network/index.html?ad####################################################################################
- up####.utorrent.com/checkupdate.php?s=############################################################################################################################################################################################################################################################################################################################################################################################################################################
- up####.utorrent.li/checkupdate.php?s=############################################################################################################################################################################################################################################################################################################################################################################################################################################
- cd#.###medianetwork.com/network/index.html?ad#######################################################################################
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- wp#d/wpad.dat
- ut#####t.utorrent.com/plus/utorrent/index.html
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
HTTP POST requests:
- be###.utorrent.com/e?i=##
UDP:
- DNS ASK cd#.###medianetwork.com
- DNS ASK be###.utorrent.com
- DNS ASK ut#####t.utorrent.com
- DNS ASK up####.utorrent.com
- DNS ASK up####.utorrent.li
- DNS ASK up####.bittorrent.com
- DNS ASK wp#d
- DNS ASK ro####.bittorrent.com
- DNS ASK www.download.windowsupdate.com
- DNS ASK ro####.utorrent.com
- 'ro####.bittorrent.com':6881
- 'ro####.utorrent.com':6881
- '<Private IP address>':5351
- '23#.#55.255.250':1900
Miscellaneous:
Searches for the following windows:
- ClassName: 'µTorrent4823DF041B09' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '?Torrent4823DF041B09' WindowName: ''