Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Security Essential' = '%APPDATA%\mssecurity\flash.exe'
Malicious functions:
Injects code into
the following system processes:
- %WINDIR%\Explorer.EXE
Modifies file system:
Creates the following files:
- %APPDATA%\mssecurity\flash.exe
Network activity:
Connects to:
- 'ii###eonom.com':80
- 'nn###rohhn.com':80
- 'sw###camcs.com':80
- 'nd###easth.com':80
- 'cu###mnocs.com':80
- 'it###rdotu.com':80
- 'uh###nwcih.com':80
- 'hc###itart.com':80
- 'cc###cwlut.com':80
- 'cd###nwdar.com':80
- 'sw###mnicr.com':80
- 'ri###dahan.com':80
- 'sf###uumai.com':80
- 'sf###lnirt.com':80
- 'mm###eennf.com':80
- 'fo###sasuh.com':80
- 'cl###wmhil.com':80
- 'hl###nowct.com':80
- 'tw###ccrrn.com':80
- 'sh###sircw.com':80
- 'ri###coccw.com':80
- 'cl###hcsfh.com':80
- 'xe##.#nf3rn0.com':80
- 'su###tontf.com':80
- 'na###onclo.com':80
- 'wd###roeof.com':80
- 'ef###rsfht.com':80
- 'sl###esurl.com':80
- 'fr###mmrhd.com':80
- 'ns###waecc.com':80
- 'rw###llrlm.com':80
- 'fn###iccad.com':80
- 'sm###nuitl.com':80
- 'ht###nweos.com':80
TCP:
HTTP POST requests:
- http://ii###eonom.com/index.php
- http://nn###rohhn.com/index.php
- http://sw###camcs.com/index.php
- http://nd###easth.com/index.php
- http://cu###mnocs.com/index.php
- http://it###rdotu.com/index.php
- http://uh###nwcih.com/index.php
- http://hc###itart.com/index.php
- http://cc###cwlut.com/index.php
- http://cd###nwdar.com/index.php
- http://sw###mnicr.com/index.php
- http://ri###dahan.com/index.php
- http://sf###uumai.com/index.php
- http://sf###lnirt.com/index.php
- http://mm###eennf.com/index.php
- http://fo###sasuh.com/index.php
- http://cl###wmhil.com/index.php
- http://hl###nowct.com/index.php
- http://tw###ccrrn.com/index.php
- http://sh###sircw.com/index.php
- http://ri###coccw.com/index.php
- http://cl###hcsfh.com/index.php
- http://xe##.#nf3rn0.com/index.php
- http://su###tontf.com/index.php
- http://na###onclo.com/index.php
- http://wd###roeof.com/index.php
- http://ef###rsfht.com/index.php
- http://sl###esurl.com/index.php
- http://fr###mmrhd.com/index.php
- http://ns###waecc.com/index.php
- http://rw###llrlm.com/index.php
- http://fn###iccad.com/index.php
- http://sm###nuitl.com/index.php
- http://ht###nweos.com/index.php
UDP:
- DNS ASK ii###eonom.com
- DNS ASK nn###rohhn.com
- DNS ASK sw###camcs.com
- DNS ASK nd###easth.com
- DNS ASK cu###mnocs.com
- DNS ASK it###rdotu.com
- DNS ASK uh###nwcih.com
- DNS ASK hc###itart.com
- DNS ASK cc###cwlut.com
- DNS ASK cd###nwdar.com
- DNS ASK sw###mnicr.com
- DNS ASK ri###dahan.com
- DNS ASK sf###uumai.com
- DNS ASK sf###lnirt.com
- DNS ASK mm###eennf.com
- DNS ASK fo###sasuh.com
- DNS ASK cl###wmhil.com
- DNS ASK hl###nowct.com
- DNS ASK tw###ccrrn.com
- DNS ASK sh###sircw.com
- DNS ASK ri###coccw.com
- DNS ASK cl###hcsfh.com
- DNS ASK xe##.#nf3rn0.com
- DNS ASK su###tontf.com
- DNS ASK na###onclo.com
- DNS ASK wd###roeof.com
- DNS ASK ef###rsfht.com
- DNS ASK sl###esurl.com
- DNS ASK fr###mmrhd.com
- DNS ASK ns###waecc.com
- DNS ASK rw###llrlm.com
- DNS ASK fn###iccad.com
- DNS ASK sm###nuitl.com
- DNS ASK ht###nweos.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
