Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d9' = '%APPDATA%\1e6f17d9.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d' = 'C:\1e6f17d9\1e6f17d9.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\1e6f17d9.exe
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
Executes the following:
- '<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet
- '<SYSTEM32>\svchost.exe' netsvcs
- '%WINDIR%\explorer.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system :
Creates the following files:
- %APPDATA%\1e6f17d9.exe
- C:\1e6f17d9\1e6f17d9.exe
Network activity:
Connects to:
- 'fr###pkipa.com':80
- 'ce######formativoviral.com':80
- 'ip##n.net':80
- 'tm####linium.com':80
- 'th####ldiehls.com':80
- 'th####merzblog.com':80
- 'xn#####sbeck.xn--p1ai':80
- 'su###nfarms.net':80
- 'co###tcon.com':80
- 'vi#####a-education.com':80
- 'eu##-dom.de':80
- 'sn###obilya.com':80
- 'sp###hsewa.com':80
- 'ko#####ctmarketing.com':80
- 'pr###movies.net':80
- 'pr####ordbekasi.com':80
- 're#####tor-service.com':80
- 'vl##x.net':80
- 'ip#####-penthouse.com':80
- 'ic####nsultancy.org':80
- 'my####rnalip.com':80
- 'ip##ddr.es':80
- 'na####lmonaj.com':80
- 'cu###yip.com':80
- 'fo#####suracembard.com':80
- 'ga####nligne.info':80
- 'da###hai.com':80
- 'my###ecom.com':80
- 'ta#####atokuichiro.com':80
- 'me##rts.com':80
- 'gr#####ternex.com.br':80
- 'as##tent.su':80
TCP:
HTTP GET requests:
- http://cu###yip.com/
- http://my####rnalip.com/raw
- http://ip##ddr.es/
HTTP POST requests:
- http://fr###pkipa.com/Zw6oOb.php?z=##########
- http://tm####linium.com/7DSCmu.php?x=##########
- http://ip##n.net/CLuOIk.php?i=##########
- http://ce######formativoviral.com/k6dYbZ.php?g=##########
- http://th####ldiehls.com/K3_J96.php?i=##########
- http://su###nfarms.net/gqd1aw.php?h=##########
- http://xn#####sbeck.xn--p1ai/7xSCFU.php?j=##########
- http://ko#####ctmarketing.com/Ml63Pu.php?b=##########
- http://co###tcon.com/evYR0G.php?b=##########
- http://sn###obilya.com/XqDZ4I.php?q=##########
- http://eu##-dom.de/TzmNHk.php?c=##########
- http://vi#####a-education.com/8Ycy6k.php?v=##########
- http://sp###hsewa.com/5a8CTM.php?l=##########
- http://pr####ordbekasi.com/6jVb5D.php?p=##########
- http://pr###movies.net/z6Hfan.php?m=##########
- http://ip#####-penthouse.com/lxUs6S.php?o=##########
- http://me##rts.com/bMUmqv.php?k=##########
- http://ta#####atokuichiro.com/TkCs3y.php?m=##########
- http://ic####nsultancy.org/nm9Eul.php?m=##########
- http://na####lmonaj.com/QoYx31.php?r=##########
- http://vl##x.net/O4vH1A.php?q=##########
- http://re#####tor-service.com/Y1U5s7.php?m=##########
- http://as##tent.su/F3eRnj.php?h=##########
- http://da###hai.com/aJPK4y.php?i=##########
- http://as##tent.su/docs/xdEjFf.php?a=##########
- http://th####merzblog.com/fQu7UH.php?w=##########
- http://my###ecom.com/EPSUrj.php?x=##########
- http://gr#####ternex.com.br/4cJIAr.php?i=##########
- http://ga####nligne.info/TiWyMt.php?b=##########
- http://fo#####suracembard.com/j97S0E.php?d=##########
UDP:
- DNS ASK tm####linium.com
- DNS ASK fr###pkipa.com
- DNS ASK ko#####ctmarketing.com
- DNS ASK ip##n.net
- DNS ASK su###nfarms.net
- DNS ASK th####ldiehls.com
- DNS ASK ce######formativoviral.com
- DNS ASK xn#####sbeck.xn--p1ai
- DNS ASK sn###obilya.com
- DNS ASK co###tcon.com
- DNS ASK no###visage.com
- DNS ASK eu##-dom.de
- DNS ASK pr####ordbekasi.com
- DNS ASK sp###hsewa.com
- DNS ASK vi#####a-education.com
- DNS ASK pr###movies.net
- DNS ASK th####merzblog.com
- DNS ASK re#####tor-service.com
- DNS ASK vl##x.net
- DNS ASK ip#####-penthouse.com
- DNS ASK ic####nsultancy.org
- DNS ASK my####rnalip.com
- DNS ASK ip##ddr.es
- DNS ASK na####lmonaj.com
- DNS ASK cu###yip.com
- DNS ASK fo#####suracembard.com
- DNS ASK ga####nligne.info
- DNS ASK da###hai.com
- DNS ASK my###ecom.com
- DNS ASK ta#####atokuichiro.com
- DNS ASK me##rts.com
- DNS ASK gr#####ternex.com.br
- DNS ASK as##tent.su
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''