Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\software\microsoft\windows\currentversion\run] 'porizegfipo' = '%HOMEPATH%\porizegfipo.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Regedit32' = '<SYSTEM32>\regedit.exe'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\c5d8393293ce2ba62f117b2c2d55bc3e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %HOMEPATH%\porizegfipo.exe
Sets the 'hidden' attribute to the following files
- %HOMEPATH%\porizegfipo.exe
Network activity
Connects to
- 'zu##eil.com':80
TCP
HTTP POST requests
- http://www.sy##tik.net/
- http://www.hu##er.hu/
- http://www.ab##.com/
- http://www.da##o.com/
- http://www.fe##auer.de/
- http://ho##-ai.com/
- http://www.11##chi.net/
- http://ge##l.com/
- http://cp##b.com/
- http://ka##am.com/
- http://www.yu###skor.kz/
- http://www.pd###mes.com/
- http://www.xa##om.es/
- http://dy###eng.com/
- http://www.me##us.si/
- http://www.ex###ive.com/
- http://da###nir.com/
- http://www.cr##i.org/
- http://ze###mot.net/
- http://mc###rope.nl/
- http://xi##ui.net/
- http://ca###nly.com/
- http://www.tc##.com/
- http://ha##ker.net/
- http://sh###gts.net/
- http://www.it##-pr.com/
- http://www.st##c.co.uk/
- http://mk##gr.com/
- http://li###l.co.jp/
- http://pe###s.co.uk/
- http://www.ot##spm.com/
- http://fd##mca.org/
- http://www.h-#.net/
- http://cp##eam.com/
- http://am##e.com/
- http://www.jc##sk.com/
- http://60##88.com/
- http://no##esse.be/
- http://www.c9##.com/
- http://t-##ust.jp/
- http://oo###anj.com/
- http://www.2p##nt.com/
- http://ca###fix.com/
- http://av#e.hu/
- http://k-##kko.com/
- http://to##do.net/
- http://ds##ars.com/
- http://www.tv##ols.fi/
- http://h-##-l.com/
- http://www.pb###mes.com/
- http://hc##.org/
- http://un##i.it/
- http://vi###tay.com/
- http://bg##.com/
- http://un##us.jp/
- http://as###eum.com/
- http://oa##h.ca/
- http://bi##e.org/
- http://re###dia.net/
- http://ku##avto.ru/
- http://ne##le.pl/
- http://www.ne##r.com/
- http://to##hfam.ca/
- http://ai###s-sa.gr/
- http://www.cr###.edu.pl/
- http://do##jog.net/
- http://cy##ad.pl/
- http://bi##oll.com/
- http://www.fi##.com/
- http://si###ann.com/
- http://yo###sut.com/
- http://www.dg##a.com/
- http://cb##en.com/
- http://www.co##sit.com/
- http://gr##wcc.com/
- http://so##wan.net/
- http://jo###yon.org/
- http://www.ph##o4b.com/
- http://sh##tas.com/
- http://wv##net.de/
- http://www.de##lo.com/
- http://us##r.com/
- http://www.mq#.com.br/
- http://www.do##n.com/
- http://www.ab##t.pl/
- http://www.ot##a.com/
- http://www.co###oko.com/
- http://www.pu#i.cz/
- http://www.tr###sib.com/
- http://www.nq##.com/
- http://www.wa##i.pl/
- http://www.va##r.se/
- http://www.ol##s.com/
- http://www.ja##mfg.com/
- http://www.sj##.org/
- http://www.sn##pak.com/
- http://www.ev##a.com/
- http://www.gp##ink.com/
- http://www.va###lit.com/
- http://www.nu###ira.com/
- http://www.sc###er3.com/
- http://www.wi##4all.nl/
- http://www.ka###-me.com/
- http://www.ed##art.hu/
- http://www.po###ood.com/
- http://www.ty##s.com/
- http://www.or##ito.com/
- http://www.my##pcb.com/
- http://www.va##al.com/
- http://www.fc##vt.org/
- http://www.sp##esi.com/
- http://www.yo###sut.com/
- http://www.lr##k.com/
- http://www.na##-a.com/
- http://www.rs##g.com/
- http://www.al##or.cl/
- http://www.fi##bc.com/
- http://www.ke###afe.com/
- http://www.or#.#cnet.jp/
- http://www.sp###hal.net/
- http://www.t-##e.com/
- http://www.ba##aku.com/
- http://sl###port.ru/
- http://www.wk##.net/
- http://bt##.com.ph/
- http://ne##no.net/
- http://ao##ko.net/
- http://ht##x.net/
- http://se##k.com/
- http://ok###imo.com/
- http://www.me##sa.info/
- http://sh##fit.com/
- http://sa###tek.net/
- http://cv##l.org/
- http://sh###ble.com/
- http://so###zer.com/
- http://to##oil.com/
- http://gy##ozo.ru/
- http://wa##apc.net/
- http://ak##niz.nl/
- http://e-##mi.net/
- http://fu##eo.com/
- http://ca##mat.com/
- http://nr##.com/
- http://www.fn##s.org/
- http://www.ce##cpa.com/
- http://www.fn#.us/
- http://www.st##um.com/
- http://www.ma###axx.com/
- http://www.ho##eman.us/
- http://www.ae##a.com/
- http://www.ia##irt.com/
- http://www.x0#.com/
- http://wa##a.com/
- http://th##ark.org/
- http://pl##ke.ua/
- http://cu###own.com/
- http://jn#.at/
- http://cc##inc.com/
- http://pc##.net/
- http://www.pw#.org/
- http://ko##e.com/
- http://ba##ari.com/
UDP
- DNS ASK sy##tik.net
- DNS ASK es##ke.net
- DNS ASK ha##ker.net
- DNS ASK re##ntl.org
- DNS ASK st##c.co.uk
- DNS ASK pe###s.co.uk
- DNS ASK no##esse.be
- DNS ASK 60##88.com
- DNS ASK ot##spm.com
- DNS ASK ai###s-sa.gr
- DNS ASK cp##eam.com
- DNS ASK ci##sc.com
- DNS ASK sl###port.ru
- DNS ASK am##e.com
- DNS ASK jc##sk.com
- DNS ASK xi##ui.net
- DNS ASK ze###mot.net
- DNS ASK to##do.net
- DNS ASK mc###rope.nl
- DNS ASK cp##b.com
- DNS ASK ho##-ai.com
- DNS ASK 11##chi.net
- DNS ASK eo##i.com
- DNS ASK ge##l.com
- DNS ASK ab##.com
- DNS ASK wv##net.de
- DNS ASK tc##.com
- DNS ASK sh###gts.net
- DNS ASK us##r.com
- DNS ASK re##oar.com
- DNS ASK bt##.com.ph
- DNS ASK se##k.com
- DNS ASK ds##ars.com
- DNS ASK do##jog.net
- DNS ASK e-##mi.net
- DNS ASK sa###tek.net
- DNS ASK cv##l.org
- DNS ASK ak##niz.nl
- DNS ASK ft##at.com
- DNS ASK ac##in.com
- DNS ASK ow##orts.ca
- DNS ASK hu##er.hu
- DNS ASK h-#.net
- DNS ASK wa##apc.net
- DNS ASK si###ath.com
- DNS ASK as###eum.com
- DNS ASK so###zer.com
- DNS ASK li###l.co.jp
- DNS ASK ag###.com.br
- DNS ASK ag###tex.com
- DNS ASK ko##e.com
- DNS ASK ul##bax.org
- DNS ASK gy##ozo.ru
- DNS ASK ca###nly.com
- DNS ASK ar##x.com
- DNS ASK me##sa.info
- DNS ASK cn##.krsn.ru
- DNS ASK jo###yon.org
- DNS ASK da##o.com
- DNS ASK fe##auer.de
- DNS ASK oh##ya.com
- DNS ASK so##wan.net
- DNS ASK gp###dit.org
- DNS ASK av#.com.sa
- DNS ASK ac##loc.com
- DNS ASK ph##o4b.com
- DNS ASK ne##le.pl
- DNS ASK ka##man.net
- DNS ASK ku##avto.ru
- DNS ASK pb###mes.com
- DNS ASK h-##-l.com
- DNS ASK k-##kko.com
- DNS ASK av#e.hu
- DNS ASK ud##ign.biz
- DNS ASK tv##ols.fi
- DNS ASK re###dia.net
- DNS ASK 10##est.com
- DNS ASK ru##e.com
- DNS ASK we##y.com
- DNS ASK vi###tay.com
- DNS ASK un##us.jp
- DNS ASK cq###oup.com
- DNS ASK oa##h.ca
- DNS ASK oo###anj.com
- DNS ASK li###gds.com
- DNS ASK ba##ari.com
- DNS ASK co##sit.com
- DNS ASK jr##.net
- DNS ASK ak#.co.id
- DNS ASK ne##r.com
- DNS ASK ex###ive.com
- DNS ASK t-##ust.jp
- DNS ASK da###nir.com
- DNS ASK ka##am.com
- DNS ASK pd###mes.com
- DNS ASK yu###skor.kz
- DNS ASK cr##i.org
- DNS ASK dy###eng.com
- DNS ASK xa##om.es
- DNS ASK me##us.si
- DNS ASK c9##.com
- DNS ASK de##lo.com
- DNS ASK zu##eil.com
- DNS ASK cb##en.com
- DNS ASK 2p##nt.com
- DNS ASK to##hfam.ca
- DNS ASK si###ann.com
- DNS ASK cr###.edu.pl
- DNS ASK bi##e.org
- DNS ASK ra##ich.de
- DNS ASK fi##.com
- DNS ASK bi##oll.com
- DNS ASK ms###ock.com
- DNS ASK ep#.com.au
- DNS ASK nm#.co.jp
- DNS ASK cl##ma.com
- DNS ASK dg##a.com
- DNS ASK vi###ndu.com
- DNS ASK ht##x.net
- DNS ASK to##oil.com
- DNS ASK va##r.se
- DNS ASK nu###ira.com
- DNS ASK va###lit.com
- DNS ASK ja##mfg.com
- DNS ASK sj##.org
- DNS ASK ol##s.com
- DNS ASK gp##ink.com
- DNS ASK sn##pak.com
- DNS ASK us##ig.com
- DNS ASK ev##a.com
- DNS ASK t-##e.com
- DNS ASK lr##k.com
- DNS ASK pe##fan.com
- DNS ASK it##-pr.com
- DNS ASK mq#.com.br
- DNS ASK ko##.net
- DNS ASK wk##.net
- DNS ASK ia##irt.com
- DNS ASK fn##s.org
- DNS ASK ce##cpa.com
- DNS ASK st##um.com
- DNS ASK fn#.us
- DNS ASK ma###axx.com
- DNS ASK ae##a.com
- DNS ASK ot##a.com
- DNS ASK tr###sib.com
- DNS ASK ab##t.pl
- DNS ASK pu#i.cz
- DNS ASK do##n.com
- DNS ASK ty##s.com
- DNS ASK po###ood.com
- DNS ASK sp##esi.com
- DNS ASK ed##art.hu
- DNS ASK or##ito.com
- DNS ASK ve##om.com
- DNS ASK va##al.com
- DNS ASK fc##vt.org
- DNS ASK yo###sut.com
- DNS ASK na##-a.com
- DNS ASK ra###ook.net
- DNS ASK ho##eman.us
- DNS ASK ba##aku.com
- DNS ASK sp###hal.net
- DNS ASK fi##bc.com
- DNS ASK or#.#cnet.jp
- DNS ASK ka###-me.com
- DNS ASK al##or.cl
- DNS ASK ke###afe.com
- DNS ASK el##o.si
- DNS ASK nq##.com
- DNS ASK sc###er3.com
- DNS ASK wa##i.pl
- DNS ASK wi##4all.nl
- DNS ASK co###oko.com
- DNS ASK my##pcb.com
- DNS ASK rs##g.com
- DNS ASK x0#.com
- DNS ASK mx#.mail.ru
- DNS ASK alt4.gmail-smtp-in.l.google.com
- DNS ASK ra#t.se
- DNS ASK gr##wcc.com
- DNS ASK ne##no.net
- DNS ASK nb##wis.com
- DNS ASK ma##ek.com
- DNS ASK th##ark.org
- DNS ASK ao##ko.net
- DNS ASK fu##eo.com
- DNS ASK pl##ke.ua
- DNS ASK av##win.com
- DNS ASK we##and.com
- DNS ASK cc##inc.com
- DNS ASK jn#.at
- DNS ASK cy##ad.pl
- DNS ASK nr##.com
- DNS ASK cu###own.com
- DNS ASK mk##gr.com
- DNS ASK tc##a.com
- DNS ASK ok###imo.com
- DNS ASK ca##ore.com
- DNS ASK mo##opp.net
- DNS ASK an##ph.org
- DNS ASK pc##.net
- DNS ASK sh##tas.com
- DNS ASK ca##mat.com
- DNS ASK sh###ble.com
- DNS ASK nt##at.com
- DNS ASK ca###fix.com
- DNS ASK wa##a.com
- DNS ASK am###for.com
- DNS ASK pw#.org
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK in#.####.messagingengine.com
- DNS ASK ma###.##gitalwaves.co.nz
- DNS ASK un##i.it
- DNS ASK zu##aha.cz
- DNS ASK sh##fit.com
- DNS ASK ik##ani.com
- DNS ASK ho#t.do
- DNS ASK mi##sh3.com
- DNS ASK an##s.net
- DNS ASK s5#.com
- DNS ASK fl##pis.com
- DNS ASK mi##nue.com
- DNS ASK ym##15.net
- DNS ASK sl##er.it
- DNS ASK n2###ina.com
- DNS ASK hc##.org
- DNS ASK rk##gg.com
- DNS ASK an##ran.com
- DNS ASK ne##.co.uk
- DNS ASK sm##ko.net
- DNS ASK bg##.com
- DNS ASK pa##ski.org
- DNS ASK fd##mca.org
- DNS ASK dz#.cz
- DNS ASK li##c.co.uk
- DNS ASK fi###ews.com
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
