Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'pmshdkes' = '%APPDATA%\pmshdkes\fyomlice.vbs'
Malicious functions:
Injects code into
the following user processes:
- wmplayer.exe
Modifies file system:
Creates the following files:
- %APPDATA%\pmshdkes\fyomlice.vbs
- %APPDATA%\pmshdkes\xphtnnkj.exe
- %APPDATA%\pmshdkes\brkkfstl.ps1
- %APPDATA%\pmshdkes\mfvcjdqy.vbs
- %TEMP%\~TM1.tmp
- %ALLUSERSPROFILE%\Application Data\kdgihdcp.log
- <LS_APPDATA>\wcxnjluo.log
Deletes the following files:
- %APPDATA%\pmshdkes\mfvcjdqy.vbs
- %TEMP%\~TM1.tmp
Network activity:
Connects to:
- 'pf###ksuctcb.eu':443
- 'qn#####uwtietjmmw.eu':443
- 'dn##prcq.eu':443
- 'uc####xrkgyhcxxu.eu':443
- 'cw#####kdjkqpbjbpfx.eu':443
- 'gh####uxbekrxms.eu':443
- 'ld#####rqtswjivedun.eu':443
- 'lc###ngkdkip.eu':443
- 'by###ykdeg.eu':443
- 'se###pugyv.eu':443
- 'qq##anqf.eu':443
- 'xk###jnkn.eu':443
- 'hj###oalgx.eu':443
- 'ni#####pkwppvsxfhcr.eu':443
- 'ew####pmkeojxbe.eu':443
- 'vk####tcirltbd.eu':443
- 'll####wyfwuyoxn.eu':443
- 'rw#####ufqmgvqqijw.eu':443
- 'nu#####mwpaoiadffw.eu':443
- 'ry####degeepc.eu':443
- 'kg###ucwrv.eu':443
- 'xt####jxcpnjgknj.eu':443
- 'of#####iapuxisxljr.eu':443
- 'oa###tell.eu':443
- 'co###nrek.eu':443
- '12#.#25.114.144':80
- 'cr###jqukjg.eu':443
- 'sw#####qrljvgpavqoj.eu':443
- 'cx#####kcnohvaqscw.eu':443
- 'jl#####rtnhnbjmdfen.eu':443
- 'kw####nmagrgkq.eu':443
- 'sr####kysjatcwl.eu':443
- 'qb####vuxpurt.eu':443
- 'lv#####kipxsykrrmmi.eu':443
- 'yh#####nhnwmvvdcwj.eu':443
- 'ak##ttli.eu':443
- 'ng#####ydplceikyo.eu':443
- 'ex###lcxixun.eu':443
UDP:
- DNS ASK uc####xrkgyhcxxu.eu
- DNS ASK pf###ksuctcb.eu
- DNS ASK se###pugyv.eu
- DNS ASK dn##prcq.eu
- DNS ASK qn#####uwtietjmmw.eu
- DNS ASK by###ykdeg.eu
- DNS ASK gh####uxbekrxms.eu
- DNS ASK cw#####kdjkqpbjbpfx.eu
- DNS ASK lc###ngkdkip.eu
- DNS ASK ll####wyfwuyoxn.eu
- DNS ASK ni#####pkwppvsxfhcr.eu
- DNS ASK qq##anqf.eu
- DNS ASK so###ftlnq.eu
- DNS ASK hj###oalgx.eu
- DNS ASK xk###jnkn.eu
- DNS ASK nu#####mwpaoiadffw.eu
- DNS ASK vk####tcirltbd.eu
- DNS ASK ew####pmkeojxbe.eu
- DNS ASK rw#####ufqmgvqqijw.eu
- DNS ASK ld#####rqtswjivedun.eu
- DNS ASK ry####degeepc.eu
- DNS ASK kg###ucwrv.eu
- DNS ASK xt####jxcpnjgknj.eu
- DNS ASK of#####iapuxisxljr.eu
- DNS ASK oa###tell.eu
- DNS ASK co###nrek.eu
- DNS ASK ba##u.com
- DNS ASK cr###jqukjg.eu
- DNS ASK sw#####qrljvgpavqoj.eu
- DNS ASK cx#####kcnohvaqscw.eu
- DNS ASK jl#####rtnhnbjmdfen.eu
- DNS ASK kw####nmagrgkq.eu
- DNS ASK sr####kysjatcwl.eu
- DNS ASK qb####vuxpurt.eu
- DNS ASK lv#####kipxsykrrmmi.eu
- DNS ASK yh#####nhnwmvvdcwj.eu
- DNS ASK ak##ttli.eu
- DNS ASK ng#####ydplceikyo.eu
- DNS ASK ex###lcxixun.eu
Miscellaneous:
Creates and executes the following:
- '<SYSTEM32>\wscript.exe' "%APPDATA%\pmshdkes\mfvcjdqy.vbs"
Executes the following:
- '%ProgramFiles%\Windows Media Player\wmplayer.exe'
