Technical Information
Malicious functions:
Creates and executes the following:
- '%HOMEPATH%\Templates\Windows\Temp\mysplash.exe'
- '%HOMEPATH%\Templates\Windows\Temp\Clean.exe'
- '%HOMEPATH%\Templates\iz\utorrent.exe' /performinstall 2
- '%HOMEPATH%\Templates\iz\mysplash.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""%HOMEPATH%\Templates\iz\xxx.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%HOMEPATH%\Templates\Windows\Temp\xxx.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\clean.bat" "
Modifies file system :
Creates the following files:
- %APPDATA%\uTorrent\apps\welcome.btapp
- %APPDATA%\uTorrent\apps\plus.btapp
- %APPDATA%\uTorrent\apps\player.btapp
- %PROGRAM_FILES%\uTorrent\uTorrent.exe
- %HOMEPATH%\Cookies\%USERNAME%@localhost[1].txt
- %ALLUSERSPROFILE%\Start Menu\µTorrent.lnk
- %TEMP%\aut1.tmp
- %TEMP%\b.wav
- %TEMP%\clean.bat
- %HOMEPATH%\Templates\Windows\Temp\mysplash.exe
- %HOMEPATH%\Templates\Windows\Temp\Clean.exe
- %HOMEPATH%\Templates\Windows\Temp\xxx.bat
- %APPDATA%\uTorrent\settings.dat.new
- %HOMEPATH%\Templates\iz\xxx.bat
- %PROGRAM_FILES%\uTorrent\utorrent.lng
- %HOMEPATH%\Templates\iz\utorrent.lng
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
- %HOMEPATH%\Templates\iz\mysplash.exe
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\1f91d2d17ea675d4c2c3192e241743f9_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %HOMEPATH%\Templates\iz\utorrent.exe
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\b12b0d87-0281-4680-9cd0-dfc795820733
Deletes the following files:
- %HOMEPATH%\Templates\Windows\Temp\mysplash.exe
- %HOMEPATH%\Templates\Windows\Temp\Clean.exe
- %HOMEPATH%\Templates\iz\utorrent.exe
- %HOMEPATH%\Templates\iz\mysplash.exe
- %TEMP%\aut1.tmp
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
- %TEMP%\b.wav
Moves the following files:
- from %APPDATA%\uTorrent\settings.dat to %APPDATA%\uTorrent\settings.dat.old
- from %HOMEPATH%\Templates\iz\utorrent.lng to %APPDATA%\uTorrent\utorrent.lng
- from %APPDATA%\uTorrent\settings.dat.new to %APPDATA%\uTorrent\settings.dat
Network activity:
Connects to:
- 'ap##.#ittorrent.com':80
- 'localhost':1035
TCP:
HTTP GET requests:
- ap##.#ittorrent.com/utorrent-onboarding/player.btapp
- ap##.#ittorrent.com/utorrent-onboarding/plus.btapp
- ap##.#ittorrent.com/utorrent-onboarding/welcome.btapp
UDP:
- DNS ASK ap##.#ittorrent.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
