Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ec525f4' = '%APPDATA%\ec525f4.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ec525f' = 'C:\ec525f4\ec525f4.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\ec525f4.exe
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
Creates and executes the following:
- '%TEMP%\3.tmp'
- '%TEMP%\2.tmp'
Executes the following:
- '<SYSTEM32>\svchost.exe' netsvcs
- '<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet
- '%WINDIR%\explorer.exe'
- '<SYSTEM32>\msiexec.exe'
Injects code into
the following system processes:
- <SYSTEM32>\msiexec.exe
- <SYSTEM32>\svchost.exe
Modifies file system :
Creates the following files:
- C:\ec525f4\ec525f4.exe
- %APPDATA%\ec525f4.exe
- %TEMP%\2.tmp
- %TEMP%\3.tmp
Deletes the following files:
- %TEMP%\2.tmp
Network activity:
Connects to:
- 'my####rnalip.com':80
- 'ip##ddr.es':80
TCP:
HTTP GET requests:
- http://my####rnalip.com/raw
- http://ip##ddr.es/
UDP:
- DNS ASK cu###yip.com
- DNS ASK microsoft.com
- DNS ASK el##son.com
- DNS ASK ip##ddr.es
- DNS ASK my####rnalip.com
- DNS ASK up####.microsoft.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
