Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '<LS_APPDATA>\a72a1ac3\X'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\a72a1ac3] 'ImagePath' = '%WINDIR%\3273271975:1490412860.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\.netbt] 'ImagePath' = '\?'
Malicious functions:
Creates and executes the following:
- <LS_APPDATA>\a72a1ac3\X
Executes the following:
- %WINDIR%\explorer.exe
Injects code into
the following system processes:
- <SYSTEM32>\winlogon.exe
- %WINDIR%\Explorer.EXE
Modifies file system :
Creates the following files:
- %WINDIR%\3273271975:1490412860.exe
- %WINDIR%\$NtUninstallKB16918$\2804554435\L\acbrwqkz
- <LS_APPDATA>\a72a1ac3\@
- <LS_APPDATA>\a72a1ac3\X
Deletes itself.
Network activity:
Connects to:
- '86.##.133.120':21810
- '58.##3.136.77':21810
- '86.##2.171.67':21810
- '85.##.113.154':21810
- '89.##2.220.33':21810
- '17#.#68.19.134':21810
- '89.##.10.230':21810
- '87.##.117.126':21810
- '95.##.243.67':21810
- '18#.#13.162.68':21810
- '89.##9.168.72':21810
- '94.##.253.249':21810
- '92.##4.213.162':21810
- '17#.#25.132.8':21810
- '17#.#29.86.87':21810
- '85.##6.137.54':21810
- '17#.#06.221.39':21810
- '79.##2.89.253':21810
- '12#.#38.2.11':21810
- '18#.25.4.67':21810
- '2.##.113.33':21810
- '17#.#16.150.83':21810
- '14.#9.54.60':21810
- '16#.#16.62.231':21810
- '24.##2.71.118':21810
- '18#.#60.34.88':21810
- '12#.#58.70.91':21810
- '17#.#63.70.150':21810
- '11#.#8.73.82':21810
- '46.##6.199.147':21810
- '15#.#55.16.185':21810
- '85.##5.78.198':21810
- '89.##2.76.71':21810
- '18#.#34.99.78':21810
- '19#.#48.51.149':21810
- '14.#8.80.58':21810
- '62.#8.58.61':21810
- '11#.#41.246.123':21810
- '95.##.175.35':21810
- '94.##3.244.37':21810
- '10#.#0.57.51':21810
- '12#.#38.11.208':21810
- '18#.#73.208.133':21810
- '77.##9.113.171':21810
- '98.##4.149.206':21810
- '88.##8.56.82':21810
- '11#.#7.51.137':21810
- '79.##0.31.12':21810
- '12#.#22.117.140':21810
- '31.#6.16.71':21810
- '46.#4.48.76':21810
- '11#.#03.199.8':21810
- '18#.#55.78.128':21810
- '11#.#41.8.252':21810
- '27.##9.32.212':21810
- '11#.#68.168.148':21810
- '18#.#3.158.184':21810
- '87.##7.93.103':21810
- '58.##.104.210':21810
- '31.##4.225.62':21810
- '12#.#01.178.44':21810
- '24.##5.250.28':21810
- '20#.#79.87.203':21810
- '14.#0.5.88':21810
- '18#.#23.38.147':21810
- '76.##4.209.184':21810
- '79.##6.115.82':21810
- '14.##.104.95':21810
- '11#.#7.160.129':21810
- '24.##9.144.133':21810
- '18#.#73.50.8':21810
- '12#.#22.68.64':21810
- '62.##.136.251':21810
- '67.##6.65.114':21810
- '19#.#99.100.244':21810
- '11#.#07.66.228':21810
- '18#.#6.229.200':21810
- '17#.#34.124.40':21810
- '18#.#15.90.76':21810
- '11#.#41.159.182':21810
- '89.##.124.239':21810
- '24.#.180.94':21810
- '17#.#41.45.49':21810
- '11#.#41.252.238':21810
- '49.#.144.50':21810
- '12#.#20.146.92':21810
- '12#.#2.37.215':21810
- '12#.#36.73.31':21810
- '18#.#2.201.239':21810
- '61.##.103.146':21810
- '19#.#54.194.207':21810
- '17#.#05.60.248':21810
- '17#.#22.193.13':21810
- '17#.#2.28.20':21810
- '79.##9.226.101':21810
- '39.##1.6.252':21810
- '79.##2.17.114':21810
- '10#.#91.227.236':21810
- '10#.#29.80.231':21810
- '11#.#52.47.91':21810
- '17#.#68.15.42':21810
- '17#.#07.24.17':21810
- '21#.#06.49.218':21810
- '20#.#22.90.190':21810
- '18#.#8.245.23':21810
- '11#.#84.27.19':21810
- '20#.#9.174.96':21810
- '18#.#35.168.99':21810
- '89.##.96.136':21810
- '17#.#84.14.98':21810
- '11#.#13.138.138':21810
- '46.##.32.229':21810
- '12#.#01.119.224':21810
- '95.##.198.176':21810
- '20#.#77.253.178':21810
- '10#.#94.125.186':21810
- '31.#.24.247':21810
- '78.##.85.188':21810
- '46.##0.120.219':21810
- '11#.#52.164.31':21810
- '96.#7.82.56':21810
- '93.##2.65.172':21810
- '18#.#41.46.165':21810
- '92.##.186.57':21810
- '17#.#2.69.142':21810
- '91.##.64.235':21810
- '11#.#68.123.248':21810
- '12#.#.130.28':21810
- '84.##4.18.35':21810
- '27.#.129.235':21810
- '58.#.187.50':21810
- '19#.#05.154.210':80
- '49.##3.76.74':21810
- '20#.#8.130.7':21810
- '46.#8.23.14':21810
- '78.##1.248.186':21810
- '11#.#00.93.36':21810
- '2.##.224.30':21810
- '10#.#08.105.69':21810
- '98.##.207.126':21810
- '12#.#36.40.254':21810
- '11#.#42.150.243':21810
- '17#.45.58.2':21810
- '62.##2.240.142':21810
- '78.##.160.86':21810
- '10#.#65.38.97':21810
- '95.#5.247.8':21810
- '93.##0.197.68':21810
- '93.##3.223.69':21810
- '12#.#08.3.206':21810
- '87.#.131.46':21810
- '19#.#4.168.51':21810
- '89.##7.194.216':21810
- '18#.#56.57.94':21810
- '12#.#00.217.103':21810
- '20#.#8.164.158':21810
- '11#.#18.228.79':21810
- '18#.#32.93.80':21810
- '20#.#31.78.198':21810
- '87.#7.69.17':21810
- '59.##.211.254':21810
- '11#.#40.191.155':21810
- '89.##6.220.24':21810
- '10#.#01.195.185':21810
- '11#.92.50.2':21810
- '17#.#18.47.244':21810
- '39.##3.46.31':21810
- '11#.#05.66.238':21810
- '87.##1.172.254':21810
- '58.##2.217.163':21810
- '18#.#34.35.14':21810
- '21#.#86.208.123':21810
- '79.##9.181.202':21810
- '14#.#36.14.209':21810
- '98.##5.136.178':21810
- '78.##.179.157':21810
- '17#.#3.109.20':21810
- '27.##9.117.243':21810
- '19#.#90.248.133':21810
- '98.##8.80.220':21810
- '11#.#05.251.154':21810
- '11#.#4.135.126':21810
- '11#.#54.248.207':21810
- '15#.#9.74.244':21810
- '46.##4.113.38':21810
- '24.##.119.253':21810
- '76.##0.165.48':21810
- '11#.#07.126.41':21810
- '17#.#5.12.77':21810
- '10#.#51.28.43':21810
- '78.##.217.191':21810
- '21#.#64.152.192':21810
- '18#.#76.36.95':21810
- '84.##.35.170':21810
- '18#.#90.223.153':21810
- '19#.#7.17.175':21810
TCP:
HTTP GET requests:
- 19#.#05.154.210/stat2.php?w=##########################################
- 19#.#05.154.210/stat2.php?w=###########################################
