Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\.netbt] 'ImagePath' = '\?'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Security Center
Executes the following:
- '<SYSTEM32>\cmd.exe'
Injects code into
the following system processes:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\winlogon.exe
- %WINDIR%\Explorer.EXE
Modifies file system:
Creates the following files:
- %WINDIR%\$NtUninstallKB27979$\4121336045\@
- %WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo
- %WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
Deletes itself.
Network activity:
Connects to:
- 'localhost':80
- 'j.###mind.com':80
TCP:
HTTP GET requests:
- http://le#####eecounters.com/5699002-2F6F334BF9ACF1B2401D3874A5B0C048/counter.img?th################################ via localhost
- http://le#####eecounters.com/5699002-2F6F334BF9ACF1B2401D3874A5B0C048/counter.img?th############################### via localhost
- http://j.###mind.com/app/geoip.js
UDP:
- DNS ASK �#�i=:
- DNS ASK �#s�U�
- DNS ASK �#I��
- DNS ASK �# �i
- DNS ASK �#���
- DNS ASK �#��
- DNS ASK �#3� �
- DNS ASK �#�Ya
- DNS ASK j.###mind.com
- DNS ASK �#�״
- DNS ASK �#*� �
- DNS ASK �#�+w3
- '37.##1.130.58':16471
- '11#.#4.104.242':16471
- '17#.#4.219.59':16471
- '97.##1.216.75':16471
- '12#.#42.162.67':16471
- '76.##.254.57':16471
- '17#.#20.108.42':16471
- '14#.#97.90.41':16471
- '77.##.143.52':16471
- '24.#.153.57':16471
- '67.##1.225.56':16471
- '22#.#54.253.254':16471
- '89.##.152.236':16471
- '11#.#2.22.95':16471
- '12#.#9.35.97':16471
- '77.##.185.233':16471
- '17#.53.7.86':16471
- '46.##.187.77':16471
- '2.##.140.239':16471
- '18#.#44.219.84':16471
- '19#.#31.114.85':16471
- '74.##.193.238':16471
- '78.##.140.247':16471
- '16#.#53.253.254':16471
- '18#.#53.253.254':16471
- '11#.#53.253.254':16471
- '18#.#52.253.254':16471
- '71.##3.253.254':16471
- '21#.#53.253.254':16471
- '75.##1.238.253':16471
- '89.#9.75.94':16471
- '88.##4.253.254':16471
- '24#.#53.253.254':16471
- '71.##4.253.254':16471
- '21#.#97.148.13':16471
- '50.#8.73.12':16471
- '18#.#54.253.254':16471
- '50.##.35.248':16471
- '18#.#.157.32':16471
- '10#.#8.202.11':16471
- '15#.#52.253.254':16471
- '17#.#52.253.254':16471
- '17#.#5.206.1':16471
- '5.###.151.10':16471
- '13#.#54.253.254':16471
