Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\.<Auxiliary name>] 'ImagePath' = '\?'
Malicious functions:
Injects code into
the following system processes:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\winlogon.exe
- %WINDIR%\Explorer.EXE
Modifies file system :
Creates the following files:
- %WINDIR%\$NtUninstallKB27979$\4121336045\@
- %WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo
- %WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
Deletes itself.
Network activity:
Connects to:
- 'localhost':80
- 'pr####.fling.com':80
TCP:
HTTP GET requests:
- le#####eecounters.com/5699002-2F6F334BF9ACF1B2401D3874A5B0C048/counter.img?th################################
- le#####eecounters.com/5699002-2F6F334BF9ACF1B2401D3874A5B0C048/counter.img?th###############################
- pr####.fling.com/geo/txt/city.php
UDP:
- DNS ASK ޡc#ٚM
- DNS ASK ޡc#H�
- DNS ASK ޡc#/m
- DNS ASK ޡc#�
- DNS ASK ޡc#!c�
- DNS ASK ޡc#mRd
- DNS ASK ޡc#x�
- DNS ASK ޡc#��v
- DNS ASK pr####.fling.com
- DNS ASK ޡc#�p
- DNS ASK ޡc#)Vk
- DNS ASK ޡc#�D
- '78.##0.105.242':16471
- '24.##6.164.242':16471
- '11#.#73.76.244':16471
- '69.##.75.239':16471
- '95.##.100.241':16471
- '12#.#10.134.241':16471
- '79.#40.11.8':16471
- '98.##0.135.218':16471
- '94.##7.55.218':16471
- '15#.#4.157.238':16471
- '18#.#1.36.235':16471
- '71.#.246.245':16471
- '79.##8.170.8':16471
- '13#.#69.173.11':16471
- '11#.#43.170.9':16471
- '11#.#06.213.232':16471
- '70.##.133.233':16471
- '13#.#14.170.12':16471
- '24.##6.57.238':16471
- '86.##0.122.238':16471
- '17#.#25.178.244':16471
- '59.##6.111.9':16471
- '82.##.221.236':16471
- '50.##2.39.237':16471
- '95.##3.169.216':16471
- '12#.#4.195.83':16471
- '12#.#45.15.67':16471
- '79.##3.90.63':16471
- '72.##6.13.111':16471
- '24.##0.79.92':16471
- '74.#0.72.88':16471
- '93.#44.9.39':16471
- '24.##.132.36':16471
- '82.#1.0.35':16471
- '11#.#34.215.58':16471
- '38.##1.254.44':16471
- '72.##0.66.43':16471
- '79.##6.13.198':16471
- '18#.#.117.194':16471
- '76.#18.7.25':16471
- '17#.#5.37.16':16471
- '72.##.85.207':16471
- '77.##6.180.16':16471
- '74.##2.199.130':16471
- '11#.#35.99.123':16471
- '24.##9.57.115':16471
- '31.##.200.150':16471
- '20#.#71.247.140':16471
- '96.##.158.137':16471
