Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''
Malicious functions:
Injects code into
the following system processes:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\services.exe
- %WINDIR%\Explorer.EXE
Modifies file system :
Creates the following files:
- C:\RECYCLER\S-1-5-18\$2ebe1c2e2a38cb36436c4d1cb8c2630c\n
- %WINDIR%\assembly\GAC\Desktop.ini
- C:\RECYCLER\S-1-5-18\$2ebe1c2e2a38cb36436c4d1cb8c2630c\@
- C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\$2ebe1c2e2a38cb36436c4d1cb8c2630c\@
- C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\$2ebe1c2e2a38cb36436c4d1cb8c2630c\n
Deletes itself.
Network activity:
Connects to:
- 'localhost':80
- 'j.###mind.com':80
TCP:
HTTP GET requests:
- fo#####-counters.com/5699145-24B8EBEDAA47374020E664A2406FB684/counter.img?th###############################
- j.###mind.com/app/geoip.js
UDP:
- DNS ASK h�#WSG|
- DNS ASK h�#߰9
- DNS ASK h�#��/
- DNS ASK h�#�x�&
- DNS ASK h�#{�
- DNS ASK h�#N!QN
- DNS ASK j.###mind.com
- DNS ASK h�#��LL
- DNS ASK h�#Hxd;
- DNS ASK h�#�� �
- '22#.#6.217.228':16471
- '14.##.134.230':16471
- '99.##5.234.230':16471
- '68.##.191.226':16471
- '98.##1.36.227':16471
- '24.##.107.228':16471
- '75.##.66.231':16471
- '10#.#7.78.234':16471
- '5.##.243.236':16471
- '76.##.239.237':16471
- '24.##3.1.232':16471
- '98.##1.90.232':16471
- '69.##6.129.232':16471
- '74.##3.188.219':16471
- '99.##2.125.220':16471
- '68.##6.196.220':16471
- '17#.#0.77.214':16471
- '18#.#76.213.214':16471
- '68.##.209.215':16471
- '98.##0.253.220':16471
- '18#.#3.81.223':16471
- '71.##.250.223':16471
- '68.##6.179.224':16471
- '71.##7.25.222':16471
- '24.##.124.222':16471
- '70.##7.19.223':16471
- '98.##1.253.254':16471
- '27.##2.253.254':16471
- '71.##2.253.254':16471
- '78.##0.253.254':16471
- '18#.#50.253.254':16471
- '88.##1.253.254':16471
- '79.##2.253.254':16471
- '16#.#53.253.254':16471
- '18#.#53.253.254':16471
- '88.##4.253.254':16471
- '88.##2.253.254':16471
- '95.##2.253.254':16471
- '17#.#52.253.254':16471
- '77.#0.8.243':16471
- '18#.#.176.243':16471
- '98.##5.2.245':16471
- '61.##.166.238':16471
- '11#.#4.132.239':16471
- '11#.#9.241.240':16471
- '75.##8.42.245':16471
- '24.##7.51.252':16471
- '98.##4.131.253':16471
- '74.##0.253.254':16471
- '72.##0.100.250':16471
- '12#.#9.247.250':16471
- '22#.#50.47.251':16471
Miscellaneous:
Searches for the following windows:
- ClassName: 'tretyhgfhgfhgf' WindowName: ''
