Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Parental Tools Location Management' = 'C:\orlxeov\ppmcrbbz.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Window Registry Intelligent Keying] 'ImagePath' = 'C:\orlxeov\ppmcrbbz.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Window Registry Intelligent Keying] 'Start' = '00000002'
Malicious functions:
Executes the following:
- 'C:\orlxeov\vbzlhte.exe' "c:\orlxeov\ppmcrbbz.exe"
- 'C:\orlxeov\ppmcrbbz.exe'
- 'C:\orlxeov\ae2siht3gr45tn6g.exe'
Modifies file system:
Creates the following files:
- C:\orlxeov\ppmcrbbz.exe
- C:\orlxeov\vbzlhte.exe
- C:\orlxeov\zgbfqym
- %WINDIR%\orlxeov\cedjnce
- C:\orlxeov\cedjnce
- C:\orlxeov\ae2siht3gr45tn6g.exe
Sets the 'hidden' attribute to the following files:
- C:\orlxeov\vbzlhte.exe
- C:\orlxeov\ppmcrbbz.exe
Deletes the following files:
- C:\orlxeov\ae2siht3gr45tn6g.exe
- %WINDIR%\orlxeov\cedjnce
Network activity:
Connects to:
- '15#.#82.245.137':33982
- '18#.#39.139.100':37599
- '2.##.19.50':35833
- '5.##.147.5':26337
- '18#.#22.43.28':46084
- '10#.#24.230.242':49777
- '11#.#18.187.28':42065
- '62.##.253.114':51156
- '41.##.10.183':48405
- '82.##7.164.91':40801
- '74.#5.64.25':22739
- '10#.#4.136.243':42581
- '24.##9.216.168':33794
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
