Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'EVGKtfJ+h34o1EPoCVTv' = '%APPDATA%\Microsoft\Media Player\shrpubw.exe'
Malicious functions:
Injects code into
the following system processes:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\cscript.exe
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\ctfmon.exe
a large number of user processes.
Terminates or attempts to terminate
the following user processes:
- safari.exe
- opera.exe
- chrome.exe
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000003'
Modifies file system:
Creates the following files:
- %APPDATA%\Microsoft\Media Player\shrpubw.exe
Deletes itself.
Network activity:
Connects to:
- '2f#######9md9thxc.main2woo.su':443
- 'e5######.www5.wownthing.cc':443
- 'r9######zyd9c.wownthing.cc':443
- 'fc######ycql.wownthing.cc':443
- '1g######log.wownthing.cc':443
- '2j######9j610.main2woo.su':443
- '3l#####857.wownthing.cc':443
- 'jt#######jq39n5zz.wownthing.cc':443
- 'qw######jtwoec6.iestats.su':443
UDP:
- DNS ASK 20#####ub2s.main2woo.su
- DNS ASK 3l######gkw3d.wownthing.cc
- DNS ASK xt######1rgv.wownthing.cc
- DNS ASK 6b#######ndn8k7hv.iestats.su
- DNS ASK bg#####g3r.iestats.su
- DNS ASK tr#######eoomw24cv.main2woo.su
- DNS ASK ys#######6g3b112y.iestats.su
- DNS ASK 5q######9aege0.main2woo.su
- DNS ASK df#######kpse9u.wownthing.cc
- DNS ASK u1######.www5.iestats.su
- DNS ASK q2#####4jmc.iestats.su
- DNS ASK xo######we2hkw.main2woo.su
- DNS ASK 4h#####lvq.iestats.su
- DNS ASK gi#######qv2xbvu76.main2woo.su
- DNS ASK ht######l.www5.main2woo.su
- DNS ASK ti#######2h92.www5.wownthing.cc
- DNS ASK ui#######9vjik06.wownthing.cc
- DNS ASK e5######.www5.wownthing.cc
- DNS ASK 1g######log.wownthing.cc
- DNS ASK fc######ycql.wownthing.cc
- DNS ASK 2f#######9md9thxc.main2woo.su
- DNS ASK 2j######9j610.main2woo.su
- DNS ASK 3l#####857.wownthing.cc
- DNS ASK jt#######jq39n5zz.wownthing.cc
- DNS ASK qw######jtwoec6.iestats.su
- DNS ASK 2b####.www5.iestats.su
- DNS ASK i4#####o2.iestats.su
- DNS ASK r9######zyd9c.wownthing.cc
- DNS ASK po####.iestats.su
- DNS ASK zb#######sx14.www5.main2woo.su
- DNS ASK mg#####xq3.main2woo.su
- DNS ASK 3v####a.main2woo.su
- DNS ASK zn#######x05t3vn08.iestats.su