Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'uTorrent' = '"%APPDATA%\uTorrent\uTorrent.exe" /MINIMIZED'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%APPDATA%\uTorrent\uTorrent.exe' = '%APPDATA%\uTorrent\uTorrent.exe:*:...
Modifies file system:
Creates the following files:
- %TEMP%\aut1.tmp
- <LS_APPDATA>\Microsoft\Internet Explorer\MSIMGSIZ.DAT
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\fileserve[1].css
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\fileserve[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\fileserve[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\fileserve[1]
- %APPDATA%\uTorrent\ie\ie.1528799238.tmp
- %APPDATA%\uTorrent\ie\ie.1528799237.tmp
- %APPDATA%\uTorrent\ie\ie.1528799236.tmp
- %APPDATA%\uTorrent\ie\ie.1528799233.tmp
- %APPDATA%\uTorrent\settings.dat.new
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\fileserve[1].png
- %APPDATA%\uTorrent\updates.dat
- %APPDATA%\uTorrent\updates\3.4.2_37594.exe
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\1f91d2d17ea675d4c2c3192e241743f9_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %APPDATA%\Microsoft\Protect\CREDHIST
- %APPDATA%\uTorrent\settings.dat
- %TEMP%\aut4.tmp
- %APPDATA%\uTorrent\maindoc.ico
- %TEMP%\aut3.tmp
- %APPDATA%\uTorrent\utorrent.lng
- %TEMP%\aut2.tmp
- %APPDATA%\uTorrent\uTorrent.exe
- %HOMEPATH%\Cookies\%USERNAME%@localhost[1].txt
- %HOMEPATH%\Desktop\µTorrent.lnk
Deletes the following files:
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut3.tmp
- %TEMP%\aut4.tmp
- %APPDATA%\uTorrent\settings.dat.old
Moves the following files:
- from %APPDATA%\uTorrent\settings.dat to %APPDATA%\uTorrent\settings.dat.old
Substitutes the following files:
- %APPDATA%\uTorrent\settings.dat
- %APPDATA%\uTorrent\settings.dat.new
Network activity:
Connects to:
- 'localhost':1041
- 'localhost':48504
- 'cd#.##.bittorrent.com':80
- 'up####.bittorrent.com':80
- 'be###.utorrent.com':80
- 'up####.utorrent.com':80
- 'up####.utorrent.li':80
TCP:
HTTP GET requests:
- http://12#.#.0.1:48504/fileserve?to########################################################################################################################## via localhost
- http://12#.#.0.1:48504/fileserve?to########################################################################################################################### via localhost
- http://cd#.##.bittorrent.com/control/feature/tags/ut.json
- http://cd#.##.bittorrent.com/control/tags/ut.json
- http://up####.bittorrent.com/time.php
- http://up####.utorrent.com/checkupdate.php?s=####################################################################################################################################################...
- http://up####.utorrent.li/checkupdate.php?s=#####################################################################################################################################################...
HTTP POST requests:
- http://be###.utorrent.com/e?i=##
UDP:
- DNS ASK ro####.bittorrent.com
- DNS ASK ro####.utorrent.com
- DNS ASK cd#.##.bittorrent.com
- DNS ASK be###.utorrent.com
- DNS ASK up####.bittorrent.com
- DNS ASK up####.utorrent.com
- DNS ASK up####.utorrent.li
- '<LOCALNET_GATEWAY>':5351
- 'ro####.bittorrent.com':6881
- '23#.#55.255.250':1900
- 'ro####.utorrent.com':6881
Miscellaneous:
Searches for the following windows:
- ClassName: '?Torrent4823DF041B09' WindowName: ''
- ClassName: 'µTorrent4823DF041B09' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Creates and executes the following:
- '%APPDATA%\uTorrent\uTorrent.exe' /MINIMIZED
