Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\software\microsoft\windows\currentversion\run] 'tibqanobatib' = '%HOMEPATH%\tibqanobatib.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Regedit32' = '<SYSTEM32>\regedit.exe'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\c5d8393293ce2ba62f117b2c2d55bc3e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %HOMEPATH%\tibqanobatib.exe
Sets the 'hidden' attribute to the following files
- %HOMEPATH%\tibqanobatib.exe
Network activity
Connects to
- 'gr###-tek.com':25
- 'va####ruckaz.com':25
- 'ho####fthewest.com':25
- 'tb##ugus.nl':25
TCP
HTTP POST requests
- http://www.ne##pak.nl/
- http://www.ja##mfg.com/
- http://av#e.hu/
- http://sn#.it/
- http://po###ime.com/
- http://fr###0ty.com/
- http://vv###knik.dk/
- http://li##c.co.uk/
- http://on##da.com/
- http://nl##.bas.bg/
- http://ka##tal.at/
- http://sk#m.ru/
- http://wv##net.de/
- http://nt#.edu.au/
- http://mk##gr.com/
- http://ju##-gr.ch/
- http://dy###eng.com/
- http://www.h-#.net/
- http://bt##.com.ph/
- http://mi##han.com/
- http://as##.org.au/
- http://ak#.co.id/
- http://ca##mat.com/
- http://dw#d.de/
- http://www.ft##at.com/
- http://ac##loc.com/
- http://ad###tist.ro/
- http://am#c.at/
- http://ka##la.fr/
- http://pe###s.co.uk/
- http://pe##ex.com/
- http://ta##les.net/
- http://mi##nue.com/
- http://to##hfam.ca/
- http://bi##oll.com/
- http://du##ps.net/
- http://ao##ko.net/
- http://an###ork.com/
- http://bo###.com.tw/
- http://www.pd###mes.com/
- http://www.gp##ink.com/
- http://vi###tay.com/
- http://ze###mot.net/
- http://ne###inx.org/
- http://hb##els.com/
- http://www.ka###-me.com/
- http://ly##.net/
- http://www.me##sa.info/
- http://www.ho##eman.us/
- http://www.ab##.com/
- http://www.pw#.org/
- http://www.dg##a.com/
- http://www.al##or.cl/
- http://www.sn##pak.com/
- http://www.fc##vt.org/
- http://www.de##lo.com/
- http://www.ty##s.com/
- http://www.st##um.com/
- http://www.qu###ock.com/
- http://www.ed##art.hu/
- http://www.or##ito.com/
- http://www.2p##nt.com/
- http://www.fn#.us/
- http://www.el##o.si/
- http://www.rs##g.com/
- http://www.mo###nic.net/
- http://www.je##o.co.uk/
- http://www.yo###sut.com/
- http://www.ab##t.pl/
- http://www.tv##ols.fi/
- http://www.fn##s.org/
- http://wa##a.com/
- http://ge##l.com/
- http://www.ol##s.com/
- http://cp##eam.com/
- http://www.sp##esi.com/
- http://www.sp###hal.net/
- http://www.ot##spm.com/
- http://www.ba##aku.com/
- http://www.pc##ate.com/
- http://www.cr##i.org/
- http://www.sj##.org/
- http://www.t-##e.com/
- http://www.co###oko.com/
- http://www.pb###mes.com/
- http://www.jc##sk.com/
- http://www.ot##a.com/
- http://www.hu##er.hu/
- http://www.xa##om.es/
- http://www.nu###ira.com/
- http://www.tr###sib.com/
- http://um##r.am/
- http://cc##i.org/
UDP
- DNS ASK je##o.co.uk
- DNS ASK ao##ko.net
- DNS ASK pd###mes.com
- DNS ASK bo###.com.tw
- DNS ASK hb##els.com
- DNS ASK th###sen.net
- DNS ASK re##oar.com
- DNS ASK du##ps.net
- DNS ASK to##hfam.ca
- DNS ASK ag###.com.br
- DNS ASK ca##ore.com
- DNS ASK an###ork.com
- DNS ASK co#
- DNS ASK pe##ex.com
- DNS ASK de
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK pe###s.co.uk
- DNS ASK sj##w.com
- DNS ASK ka##la.fr
- DNS ASK aw#l.ws
- DNS ASK wn##voy.com
- DNS ASK di###phone.com
- DNS ASK ta##les.net
- DNS ASK or#
- DNS ASK dw#d.de
- DNS ASK mu##ip.hu
- DNS ASK gr###-tek.com
- DNS ASK ac##in.com
- DNS ASK nt#.edu.au
- DNS ASK li##c.co.uk
- DNS ASK an##ph.org
- DNS ASK bi##oll.com
- DNS ASK nl##.bas.bg
- DNS ASK ka##tal.at
- DNS ASK on##da.com
- DNS ASK vv###knik.dk
- DNS ASK sn#.it
- DNS ASK po###ime.com
- DNS ASK av#e.hu
- DNS ASK cn##.krsn.ru
- DNS ASK in##ctus.pl
- DNS ASK ne###inx.org
- DNS ASK sl##er.it
- DNS ASK ka##man.net
- DNS ASK ja##mfg.com
- DNS ASK vi###tay.com
- DNS ASK mi##nue.com
- DNS ASK ak#.co.id
- DNS ASK dy###oup.com
- DNS ASK ad###tist.ro
- DNS ASK ca##mat.com
- DNS ASK xi##ui.net
- DNS ASK me######gministriesint.com
- DNS ASK ns##.##maincontrol.com
- DNS ASK ra#########talllc.com.1.0001.arsmtp.com
- DNS ASK f1####2.dnspod.net
- DNS ASK m.####-servers.net
- DNS ASK dy########ine.com.2.0001.arsmtp.com
- DNS ASK ep###pts.com
- DNS ASK hb###.##m.1.0001.arsmtp.com
- DNS ASK j.####-servers.net
- DNS ASK ra#########talllc.com.2.0001.arsmtp.com
- DNS ASK yw####ssclay.org
- DNS ASK mx####.carrierzone.com
- DNS ASK pe##als.com
- DNS ASK bo#########xas.org.1.0001.arsmtp.com
- DNS ASK gw####.fortimail.com
- DNS ASK pn#.dtag.de
- DNS ASK ha##aik.net
- DNS ASK ep######.com.1.0001.arsmtp.com
- DNS ASK hb#.com
- DNS ASK li#k
- DNS ASK bo#########xas.org.2.0001.arsmtp.com
- DNS ASK ou##ooc.com
- DNS ASK tb##ugus.nl
- DNS ASK ns#.####egistrymarket.link
- DNS ASK ya###nus.edu.sg
- DNS ASK mk##gr.com
- DNS ASK mo##opp.net
- DNS ASK hb###.##m.2.0001.arsmtp.com
- DNS ASK wi###ire.com
- DNS ASK va####ruckaz.com
- DNS ASK di#.#ssd.org
- DNS ASK ed###gal.com
- DNS ASK hb##i.com
- DNS ASK ho####fthewest.com
- DNS ASK wi#.net
- DNS ASK ca
- DNS ASK au
- DNS ASK ns#.#telos.net
- DNS ASK ra#####capitalllc.com
- DNS ASK et##ex.com
- DNS ASK mx#######201.gslb.pphosted.com
- DNS ASK si##cam.com
- DNS ASK dy####conline.com
- DNS ASK t-###tems.com
- DNS ASK f1####1.dnspod.net
- DNS ASK cs##an.ca
- DNS ASK sg
- DNS ASK ns#.##gelwire.net
- DNS ASK bo####lletexas.org
- DNS ASK ph####xhouse.org.au
- DNS ASK mx#####.ppe-hosted.com
- DNS ASK ns#.#nsv2.com
- DNS ASK ne#
- DNS ASK fr###0ty.com
- DNS ASK am#c.at
- DNS ASK sk#m.ru
- DNS ASK nu###ira.com
- DNS ASK xa##om.es
- DNS ASK hu##er.hu
- DNS ASK jc##sk.com
- DNS ASK ot##a.com
- DNS ASK ve##om.com
- DNS ASK pe##fan.com
- DNS ASK pb###mes.com
- DNS ASK co###oko.com
- DNS ASK t-##e.com
- DNS ASK vi###ndu.com
- DNS ASK cr##i.org
- DNS ASK sj##.org
- DNS ASK ba##aku.com
- DNS ASK pc##ate.com
- DNS ASK ot##spm.com
- DNS ASK ra###ook.net
- DNS ASK sp###hal.net
- DNS ASK jr##.net
- DNS ASK cc##i.org
- DNS ASK ke###web.com
- DNS ASK tv##ols.fi
- DNS ASK yo###sut.com
- DNS ASK tr###sib.com
- DNS ASK ma##.#-email.net
- DNS ASK js##s.com
- DNS ASK ud##ign.biz
- DNS ASK re##era.com
- DNS ASK fn#.us
- DNS ASK ko##.net
- DNS ASK el##o.si
- DNS ASK mo###nic.net
- DNS ASK rs##g.com
- DNS ASK ow##orts.ca
- DNS ASK st##um.com
- DNS ASK ed##art.hu
- DNS ASK qu###ock.com
- DNS ASK ne##pak.nl
- DNS ASK 2p##nt.com
- DNS ASK ho##eman.us
- DNS ASK it##-pr.com
- DNS ASK ty##s.com
- DNS ASK de##lo.com
- DNS ASK fc##vt.org
- DNS ASK sn##pak.com
- DNS ASK al##or.cl
- DNS ASK dg##a.com
- DNS ASK pw#.org
- DNS ASK ab##.com
- DNS ASK or##ito.com
- DNS ASK ab##t.pl
- DNS ASK dn##.telekom.de
- DNS ASK is##.org
- DNS ASK am##-tc.si
- DNS ASK at##-sk.ca
- DNS ASK lp##r.com
- DNS ASK ma###.##gitalwaves.co.nz
- DNS ASK gp##ink.com
- DNS ASK bt##.com.ph
- DNS ASK si##tar.com
- DNS ASK ds##ars.com
- DNS ASK ac##loc.com
- DNS ASK h-##-l.com
- DNS ASK at##uk.org
- DNS ASK aw###ser.com
- DNS ASK as##.org.au
- DNS ASK x9#.com
- DNS ASK wa##apc.net
- DNS ASK cq###oup.com
- DNS ASK h-#.net
- DNS ASK ft##at.com
- DNS ASK dy###eng.com
- DNS ASK ze###mot.net
- DNS ASK ju##-gr.ch
- DNS ASK an##s.net
- DNS ASK we##y.com
- DNS ASK po##ook.com
- DNS ASK bg##.com
- DNS ASK ca###fix.com
- DNS ASK ba##ari.com
- DNS ASK fn##s.org
- DNS ASK ge##l.com
- DNS ASK sp##esi.com
- DNS ASK mx#.mail.ru
- DNS ASK ol##s.com
- DNS ASK cp##eam.com
- DNS ASK cl##ma.com
- DNS ASK bu##tner.ru
- DNS ASK alt4.gmail-smtp-in.l.google.com
- DNS ASK ly##.net
- DNS ASK wa##a.com
- DNS ASK an##ran.com
- DNS ASK ru##e.com
- DNS ASK ka###-me.com
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK mi##han.com
- DNS ASK um##r.am
- DNS ASK me##sa.info
- DNS ASK in#.####.messagingengine.com
- DNS ASK wv##net.de
- DNS ASK no##s.ru
- DNS ASK so###zer.com
- DNS ASK wo##plus.hu
- DNS ASK lu##a.cz
- DNS ASK ka###iba.com
- DNS ASK ep######.com.2.0001.arsmtp.com
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\svchost.exe'