Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Security Essential' = '%APPDATA%\mssecurity\flash.exe'
Modifies file system:
Creates the following files:
- %APPDATA%\mssecurity\flash.exe
Network activity:
Connects to:
- 'it###rdott.com':80
- 'cu###mnocc.com':80
- 'hc###itaru.com':80
- 'ef###rsfhu.com':80
- 'ns###waecs.com':80
- 'fr###mmrhi.com':80
- 'uh###nwcil.com':80
- 'sw###camcc.com':80
- 'cc###cwluu.com':80
- 'mm###eenna.com':80
- 'nn###rohhr.com':80
- 'ii###eonoe.com':80
- 'nd###eastl.com':80
- 'sl###esurh.com':80
- 'su###tonta.com':80
- 'tw###ccrrr.com':80
- 'hl###nowcu.com':80
- 'xe##.#nf3rn0.com':80
- 'cl###hcsfl.com':80
- 'na###onclw.com':80
- 'ri###cocco.com':80
- 'rw###llrle.com':80
- 'ht###nweoc.com':80
- 'sm###nuith.com':80
- 'sh###sirco.com':80
- 'wd###roeoa.com':80
- 'fn###iccai.com':80
TCP:
HTTP POST requests:
- http://it###rdott.com/index.php
- http://cu###mnocc.com/index.php
- http://hc###itaru.com/index.php
- http://ef###rsfhu.com/index.php
- http://ns###waecs.com/index.php
- http://fr###mmrhi.com/index.php
- http://uh###nwcil.com/index.php
- http://sw###camcc.com/index.php
- http://cc###cwluu.com/index.php
- http://mm###eenna.com/index.php
- http://nn###rohhr.com/index.php
- http://ii###eonoe.com/index.php
- http://nd###eastl.com/index.php
- http://sl###esurh.com/index.php
- http://su###tonta.com/index.php
- http://tw###ccrrr.com/index.php
- http://hl###nowcu.com/index.php
- http://xe##.#nf3rn0.com/index.php
- http://cl###hcsfl.com/index.php
- http://na###onclw.com/index.php
- http://ri###cocco.com/index.php
- http://rw###llrle.com/index.php
- http://ht###nweoc.com/index.php
- http://sm###nuith.com/index.php
- http://sh###sirco.com/index.php
- http://wd###roeoa.com/index.php
- http://fn###iccai.com/index.php
UDP:
- DNS ASK cu###mnocc.com
- DNS ASK hc###itaru.com
- DNS ASK uh###nwcil.com
- DNS ASK it###rdott.com
- DNS ASK ef###rsfhu.com
- DNS ASK ns###waecs.com
- DNS ASK fr###mmrhi.com
- DNS ASK cc###cwluu.com
- DNS ASK mm###eenna.com
- DNS ASK sf###lniru.com
- DNS ASK sw###camcc.com
- DNS ASK nn###rohhr.com
- DNS ASK ii###eonoe.com
- DNS ASK nd###eastl.com
- DNS ASK tw###ccrrr.com
- DNS ASK hl###nowcu.com
- DNS ASK ri###cocco.com
- DNS ASK su###tonta.com
- DNS ASK xe##.#nf3rn0.com
- DNS ASK cl###hcsfl.com
- DNS ASK na###onclw.com
- DNS ASK ht###nweoc.com
- DNS ASK sm###nuith.com
- DNS ASK sl###esurh.com
- DNS ASK rw###llrle.com
- DNS ASK sh###sirco.com
- DNS ASK wd###roeoa.com
- DNS ASK fn###iccai.com
