Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SonyAgent' = '<Full path to virus>'
Malicious functions:
Executes the following:
- '<SYSTEM32>\wermgr.exe' -queuereporting
Modifies file system :
Sets the 'hidden' attribute to the following files:
- <Full path to virus>
Network activity:
Connects to:
- '18#.#54.163.37':80
- '10#.#7.184.14':80
- '10#.#54.152.65':80
- '17#.#4.98.33':80
- '91.##7.100.28':80
- '78.##.108.48':80
- '89.##0.227.15':80
- '17#.#50.170.64':80
- '5.##8.69.50':80
- '93.##3.230.11':80
- '94.##.120.24':80
- '31.##8.186.43':80
- '77.##3.75.16':80
- '17#.#60.190.22':80
- '10#.#54.50.71':80
- '18#.#35.187.14':80
- '11#.#52.41.32':80
- '37.##5.99.25':80
- '18#.#40.254.52':80
- '18#.#30.9.64':80
- '31.##3.92.21':80
- '94.##.106.36':80
- '37.#29.8.20':80
- '94.##4.131.67':80
- '17#.#.194.72':80
- '81.##.191.30':80
- '77.##1.239.59':80
- '94.##3.80.66':80
- '91.##4.72.69':80
- '91.##3.34.52':80
- '11#.#4.194.60':80
- '10#.#51.126.26':80
- '59.##1.197.26':80
- '17#.#50.55.54':80
- '17#.#09.232.61':80
- '31.##9.116.61':80
- '46.##9.85.20':80
- '91.##4.168.65':80
- '20#.#47.220.15':80
- 'localhost':49176
- '17#.8.12.7':80
- 'localhost':49173
- '77.##8.199.45':80
- 'localhost':49179
- '5.###.190.132':80
- 'localhost':49185
- '78.##.114.49':80
- 'localhost':49182
- '46.#11.46.3':80
- 'localhost':49161
- '77.#22.95.5':80
- 'localhost':49158
- '85.##8.81.26':80
- 'localhost':49164
- '86.##.229.137':80
- 'localhost':49170
- '46.#9.58.51':80
- 'localhost':49167
- '10#.#62.44.20':80
- 'localhost':49206
- '85.##4.38.179':80
- 'localhost':49203
- '46.##9.227.86':80
- 'localhost':49209
- '46.##8.18.78':80
- 'localhost':49215
- '77.##2.69.16':80
- 'localhost':49212
- '19#.#07.132.19':80
- 'localhost':49191
- '31.##9.104.185':80
- 'localhost':49188
- '46.##5.52.95':80
- 'localhost':49194
- '17#.#.183.82':80
- 'localhost':49200
- '10#.#7.125.18':80
- 'localhost':49197
TCP:
HTTP GET requests:
- 20#.#47.220.15/login.htm
- 91.##4.168.65/default.htm
- 17#.#09.232.61/default.htm
- 46.##9.85.20/file.htm
- 85.##8.81.26/online.htm
- 31.##9.116.61/login.htm
- 11#.#4.194.60/file.htm
- 17#.#50.55.54/online.htm
- 59.##1.197.26/login.htm
- 10#.#51.126.26/start.htm
- 77.#22.95.5/welcome.htm
- 77.##2.69.16/search.htm
- 91.##3.34.52/search.htm
- 78.##.114.49/search.htm
- 91.##4.72.69/online.htm
- 94.##3.80.66/online.htm
- 10#.#62.44.20/start.htm
- 77.##1.239.59/start.htm
- 81.##.191.30/search.htm
- 94.##4.131.67/start.htm
- 77.##3.75.16/welcome.htm
- 37.#29.8.20/welcome.htm
- 17#.#.194.72/login.htm
- 94.##.106.36/default.htm
- 31.##3.92.21/default.htm
- 18#.#40.254.52/file.htm
- 37.##5.99.25/file.htm
- 17#.8.12.7/login.htm
- 93.##3.230.11/welcome.htm
- 11#.#52.41.32/search.htm
- 18#.#35.187.14/search.htm
- 31.##8.186.43/start.htm
- 94.##.120.24/login.htm
- 17#.#60.190.22/login.htm
- 10#.#7.125.18/default.htm
- 10#.#54.50.71/default.htm
- 19#.#07.132.19/main.htm
- 10#.#54.152.65/start.htm
- 5.##8.69.50/start.htm
- 17#.#50.170.64/search.htm
- 46.#9.58.51/file.htm
- 18#.#30.9.64/default.htm
- 89.##0.227.15/default.htm
- 78.##.108.48/start.htm
- 18#.#54.163.37/default.htm
- 77.##8.199.45/default.htm
- 17#.#4.98.33/main.htm
- 91.##7.100.28/file.htm
- 10#.#7.184.14/login.htm
- 46.#11.46.3/login.htm
