Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Storage Secure Isolation Driver' = 'C:\fpjgroywyzuv\iibnwmkwldde.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Cryptographic Solutions User Superfetch] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- 'C:\fpjgroywyzuv\laxwgvkmlkic.exe' "c:\fpjgroywyzuv\iibnwmkwldde.exe"
- 'C:\fpjgroywyzuv\iibnwmkwldde.exe'
- 'C:\fpjgroywyzuv\ul653xjuhonhdagavw17.exe'
Modifies file system :
Creates the following files:
- C:\fpjgroywyzuv\iibnwmkwldde.exe
- C:\fpjgroywyzuv\laxwgvkmlkic.exe
- C:\fpjgroywyzuv\ul653xjuhonhdagavw17.exe
- %WINDIR%\fpjgroywyzuv\haxlzmx6y1
- C:\fpjgroywyzuv\haxlzmx6y1
Sets the 'hidden' attribute to the following files:
- C:\fpjgroywyzuv\laxwgvkmlkic.exe
- C:\fpjgroywyzuv\iibnwmkwldde.exe
Deletes the following files:
- C:\fpjgroywyzuv\ul653xjuhonhdagavw17.exe
- %WINDIR%\fpjgroywyzuv\haxlzmx6y1
Network activity:
Connects to:
- 'fi####valley.net':80
- 'th####valley.net':80
- 'fi####sister.net':80
- 'th####sister.net':80
- 'fi###elabor.net':80
- 'ci####ttesilver.net':80
- 'pi####esister.net':80
- 'th###hlabor.net':80
- 'pi####esilver.net':80
- 'ri###sister.net':80
- 'wh####rvalley.net':80
- 'ri###silver.net':80
- 'wh####rsister.net':80
- 'ri###valley.net':80
- 'fi####silver.net':80
- 'th####silver.net':80
- 'wh####rlabor.net':80
- 'ri###labor.net':80
TCP:
HTTP GET requests:
- http://fi####valley.net/index.php
- http://th####valley.net/index.php
- http://fi####sister.net/index.php
- http://th####sister.net/index.php
- http://fi###elabor.net/index.php
- http://ci####ttesilver.net/index.php
- http://pi####esister.net/index.php
- http://th###hlabor.net/index.php
- http://pi####esilver.net/index.php
- http://ri###sister.net/index.php
- http://wh####rvalley.net/index.php
- http://ri###silver.net/index.php
- http://wh####rsister.net/index.php
- http://ri###valley.net/index.php
- http://fi####silver.net/index.php
- http://th####silver.net/index.php
- http://wh####rlabor.net/index.php
- http://ri###labor.net/index.php
UDP:
- DNS ASK th####valley.net
- DNS ASK fi###elabor.net
- DNS ASK th####sister.net
- DNS ASK fi####valley.net
- DNS ASK th###hlabor.net
- DNS ASK pi####esister.net
- DNS ASK ci####ttesister.net
- DNS ASK pi####esilver.net
- DNS ASK ci####ttesilver.net
- DNS ASK fi####sister.net
- DNS ASK ri###sister.net
- DNS ASK wh####rvalley.net
- DNS ASK ri###silver.net
- DNS ASK wh####rsister.net
- DNS ASK ri###valley.net
- DNS ASK fi####silver.net
- DNS ASK th####silver.net
- DNS ASK wh####rlabor.net
- DNS ASK ri###labor.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
