Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '"%APPDATA%\sV4TV3H0xpakyipg\MN5Z1U5eVntJ.exe",explorer.exe'
Modifies file system:
Creates the following files:
- %APPDATA%\Imminent\Monitoring\network.dat
- %APPDATA%\Imminent\Monitoring\system.dat
- %APPDATA%\sV4TV3H0xpakyipg\MN5Z1U5eVntJ.exe
- %APPDATA%\Imminent\Logs\06-11-2017
Sets the 'hidden' attribute to the following files:
- %APPDATA%\sV4TV3H0xpakyipg\MN5Z1U5eVntJ.exe
Network activity:
Connects to:
- 'sf.##mcb.com':80
- 'cr###s.hopto.me':9003
- 'wp#d':80
- 'crl.verisign.com':80
TCP:
HTTP GET requests:
- http://crl.verisign.com/pca3-g5.crl
- http://sf.##mcb.com/sf.crl
- http://11#.#11.111.1/wpad.dat via wp#d
- http://crl.verisign.com/pca3.crl
UDP:
- DNS ASK sf.##mcb.com
- DNS ASK cr###s.hopto.me
- DNS ASK wp#d
- DNS ASK crl.verisign.com
