Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'BranchCache Font Registrar Name Provider' = '<SYSTEM32>\ctiacmwr.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Encrypting Server Sharing Bus Drive] 'ImagePath' = '<SYSTEM32>\ctiacmwr.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Encrypting Server Sharing Bus Drive] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- Windows Security Center
Executes the following:
- '<SYSTEM32>\aoorbdzmc.exe' "<SYSTEM32>\ctiacmwr.exe"
- '%WINDIR%\Temp\zinjius13gucnodw9.exe' -r 40663 tcp
- '%TEMP%\zinjius139penodw9zmmlvi.exe'
- '<SYSTEM32>\ctiacmwr.exe'
Modifies file system:
Creates the following files:
- <SYSTEM32>\oxbdgkxphsbpom\run
- <SYSTEM32>\oxbdgkxphsbpom\rng
- %WINDIR%\Temp\zinjius13gucnodw9.exe
- <SYSTEM32>\oxbdgkxphsbpom\cfg
- <SYSTEM32>\aoorbdzmc.exe
- %TEMP%\zinjius139penodw9zmmlvi.exe
- <SYSTEM32>\oxbdgkxphsbpom\tst
- <SYSTEM32>\ctiacmwr.exe
- <SYSTEM32>\oxbdgkxphsbpom\etc
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\aoorbdzmc.exe
- <SYSTEM32>\ctiacmwr.exe
Deletes the following files:
- %WINDIR%\Temp\zinjius13gucnodw9.exe
- <DRIVERS>\etc\hosts
Substitutes the HOSTS file.
Network activity:
Connects to:
- 'ha###hine.net':80
- 'hu###shine.net':80
- 'ha###one.net':80
- 'hu###done.net':80
- 'ma###ush.net':80
- 'wr###rush.net':80
- 'ha###ifth.net':80
- 'hu###fifth.net':80
- 'mu###shine.net':80
- 'ya###hine.net':80
- 'mu###done.net':80
- 'ya###one.net':80
- 'ha###new.net':80
- 'hu###knew.net':80
- 'mu###fifth.net':80
- 'ya###ifth.net':80
- 'ne####arydress.net':80
- 'gl###health.net':80
- 'li####appear.net':80
- 're####erpaint.net':80
- 'mi####lossary.net':80
- 'st###march.net':80
- 'ge####friend.net':80
- 're####eneither.net':80
- 'ma###lock.net':80
- 'wr###clock.net':80
- 'ma###ake.net':80
- 'wr###make.net':80
- 'ro###ush.net':80
- 'th####hcountry.net':80
- 'ma###ard.net':80
- 'wr###hard.net':80
TCP:
HTTP GET requests:
- http://ha###hine.net/forum/search.php?me#########################################
- http://hu###shine.net/forum/search.php?me#########################################
- http://ha###one.net/forum/search.php?me#########################################
- http://hu###done.net/forum/search.php?me#########################################
- http://ma###ush.net/forum/search.php?me#########################################
- http://wr###rush.net/forum/search.php?me#########################################
- http://ha###ifth.net/forum/search.php?me#########################################
- http://hu###fifth.net/forum/search.php?me#########################################
- http://mu###shine.net/forum/search.php?me#########################################
- http://ya###hine.net/forum/search.php?me#########################################
- http://mu###done.net/forum/search.php?me#########################################
- http://ya###one.net/forum/search.php?me#########################################
- http://ha###new.net/forum/search.php?me#########################################
- http://hu###knew.net/forum/search.php?me#########################################
- http://mu###fifth.net/forum/search.php?me#########################################
- http://ya###ifth.net/forum/search.php?me#########################################
- http://ne####arydress.net/forum/search.php?me#########################################
- http://gl###health.net/forum/search.php?me#########################################
- http://li####appear.net/forum/search.php?me#########################################
- http://re####erpaint.net/forum/search.php?me#########################################
- http://mi####lossary.net/forum/search.php?me#########################################
- http://st###march.net/forum/search.php?me#########################################
- http://ge####friend.net/forum/search.php?me#########################################
- http://re####eneither.net/forum/search.php?me#########################################
- http://ma###lock.net/forum/search.php?me#########################################
- http://wr###clock.net/forum/search.php?me#########################################
- http://ma###ake.net/forum/search.php?me#########################################
- http://wr###make.net/forum/search.php?me#########################################
- http://ro###ush.net/forum/search.php?me#########################################
- http://th####hcountry.net/forum/search.php?me#########################################
- http://ma###ard.net/forum/search.php?me#########################################
- http://wr###hard.net/forum/search.php?me#########################################
UDP:
- DNS ASK ha###hine.net
- DNS ASK hu###shine.net
- DNS ASK ha###one.net
- DNS ASK hu###done.net
- DNS ASK ma###ush.net
- DNS ASK wr###rush.net
- DNS ASK ha###ifth.net
- DNS ASK hu###fifth.net
- DNS ASK hu###knew.net
- DNS ASK ya###one.net
- DNS ASK mu###shine.net
- DNS ASK ya###new.net
- DNS ASK mu###done.net
- DNS ASK ya###ifth.net
- DNS ASK ha###new.net
- DNS ASK ya###hine.net
- DNS ASK mu###fifth.net
- DNS ASK ma###ake.net
- DNS ASK gl###health.net
- DNS ASK ge####friend.net
- DNS ASK re####erpaint.net
- DNS ASK ne####arydress.net
- DNS ASK ta###fruit.net
- DNS ASK st###march.net
- DNS ASK re####eneither.net
- DNS ASK mi####lossary.net
- DNS ASK wr###clock.net
- DNS ASK ma###ard.net
- DNS ASK wr###make.net
- DNS ASK ma###lock.net
- DNS ASK th####hcountry.net
- DNS ASK li####appear.net
- DNS ASK wr###hard.net
- DNS ASK ro###ush.net
- '23#.#55.255.250':1900