Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '9c3c2f2' = '"<LS_APPDATA>\eviba\eviba.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '9c3c2f2' = '"<LS_APPDATA>\eviba\eviba.exe"'
Malicious functions:
Creates and executes the following:
- '%TEMP%\WindowsXP-KB968930-x86-ENG.exe' /quiet /norestart
- '%TEMP%\WindowsXP-KB968930-x86-ENG.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\svchost.exe'
Injects code into
the following user processes:
- java.exe
- javaw.exe
- firefox.exe
- iexplore.exe
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1206' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2300' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1809' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1206' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2300' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1809' = '00000003'
Modifies file system :
Creates the following files:
- %TEMP%\WindowsXP-KB968930-x86-ENG.exe
- <LS_APPDATA>\eviba\eviba.exe
Deletes itself.
Network activity:
Connects to:
- '21#.#8.246.1':80
- '22#.#6.173.69':80
- '14#.#74.101.61':80
- '17#.#2.28.50':443
- '3.##.211.36':80
- '14#.#11.98.7':80
- '28.##5.252.118':80
- '13#.#36.234.89':80
- '24#.#79.140.139':80
- '23.##.57.202':443
- '79.##.163.92':80
- '20#.#78.103.139':8080
- '14#.#25.172.50':80
- '24#.#4.223.90':80
- '34.#3.111.7':80
- '24#.#90.167.89':8080
- '24#.#34.195.42':80
- '19#.#32.124.209':80
- '14.##1.85.133':80
- '18#.#0.188.7':80
- '12#.#92.242.213':80
- '20#.#6.232.182':80
- '14#.#7.39.84':80
- '19#.#4.195.247':443
- '16#.#83.142.71':80
- '18#.#8.40.128':8080
- '66.##9.77.137':80
- '86.##.231.227':80
- '10#.#12.29.98':80
- '24#.#9.115.245':443
- '18#.#78.18.249':80
- '18#.#6.74.141':80
TCP:
HTTP GET requests:
- http://do#####d.microsoft.com/download/E/C/E/ECE99583-2003-455D-B681-68DB610B44A4/WindowsXP-KB968930-x86-ENG.exe via 20#.#6.232.182
- http://microsoft.com/ via 20#.#6.232.182
UDP:
- DNS ASK do#####d.microsoft.com
- DNS ASK microsoft.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
- ClassName: '' WindowName: 'ID GUID'
