Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SafeMode' = '%ALLUSERSPROFILE%\Application Data\Desktop Window Manager\Desktop Window Manager\1.0.0.0\hfile.exe'
Malicious functions:
Creates and executes the following:
- %TEMP%\CDK.exe (downloaded from the Internet)
- %TEMP%\Svhost.exe (downloaded from the Internet)
Terminates or attempts to terminate
the following user processes:
- zlclient.exe
- smc.exe
- fsav32.exe
Modifies file system :
Creates the following files:
- %TEMP%\laga.txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\MZ%EF%BF%BD[1]
- %TEMP%\ss.txt
- %TEMP%\sss.txt
- %TEMP%\time.txt
- C:\emsg.txt
- %TEMP%\end.txt
- %TEMP%\ShellLast.txt
- %TEMP%\msg.txt
- C:\BITMAfP.png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\MZ%EF%BF%BD[1]
- %TEMP%\Conf.txt
- %TEMP%\SystemCon.txt
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-1275210071-117609710-1801674531-500\34a06a66489d801aae3fcdd19605f7da_ffcb838e-6d3b-4e44-a259-8ac8f5c94c4f
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\9f12dc7a088631d5bb2be9190242b742_ffcb838e-6d3b-4e44-a259-8ac8f5c94c4f
- <SYSTEM32>\Microsoft\Protect\S-1-5-18\4b3fd747-b9b3-4f76-907a-9aa4324c2cb4
- %APPDATA%\Microsoft\Protect\S-1-5-21-1275210071-117609710-1801674531-500\1e561af1-f34a-4396-aafa-b18933c3bdc1
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-1275210071-117609710-1801674531-500\58f2f8e765182c09ee07f74e15073426_ffcb838e-6d3b-4e44-a259-8ac8f5c94c4f
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-1275210071-117609710-1801674531-500\ca68747b00b76b834c7b06b733cbbfa3_ffcb838e-6d3b-4e44-a259-8ac8f5c94c4f
- %TEMP%\IP.txt
- %ALLUSERSPROFILE%\Application Data\Desktop Window Manager\Desktop Window Manager\1.0.0.0\hfile.exe
- %TEMP%\Last.txt
- <SYSTEM32>\Microsoft\Protect\S-1-5-18\Preferred
- %TEMP%\Svhost.exe
- %TEMP%\CDK.exe
Deletes the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\MZ%EF%BF%BD[1]
- %TEMP%\ss.txt
- %TEMP%\Conf.txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\MZ%EF%BF%BD[1]
- C:\BITMAfP.png
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\9f12dc7a088631d5bb2be9190242b742_ffcb838e-6d3b-4e44-a259-8ac8f5c94c4f
- %TEMP%\IP.txt
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-1275210071-117609710-1801674531-500\58f2f8e765182c09ee07f74e15073426_ffcb838e-6d3b-4e44-a259-8ac8f5c94c4f
- %TEMP%\laga.txt
- %TEMP%\sss.txt
Network activity:
Connects to:
- 'up##pet.org':21
- 'localhost':1041
- 'up##pet.org':80
- 'www.wh###smyip.com':80
TCP:
HTTP GET requests:
- up##pet.org/ri0t/rat/Victims.txt
- up##pet.org/ri0t/time.php
- up##pet.org/ri0t/rat/MZ%EF%BF%BD
- up##pet.org/ri0t/Svhost.exe
- up##pet.org/ri0t/Plugin.exe
- www.wh###smyip.com/automation/n09230945.asp
UDP:
- DNS ASK www.wh###smyip.com
- DNS ASK up##pet.org
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
