Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ec525f4' = '%APPDATA%\ec525f4.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ec525f' = 'C:\ec525f4\ec525f4.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\ec525f4.exe
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
Executes the following:
- '<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet
- '<SYSTEM32>\svchost.exe' netsvcs
- '%WINDIR%\explorer.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system :
Creates the following files:
- %APPDATA%\ec525f4.exe
- C:\ec525f4\ec525f4.exe
Network activity:
Connects to:
- 'ad###walk.com':80
- 'me###g.com.br':80
- 'te###turk.com':80
- 'la####sinhvien.net':80
- 'li####llardemo.net':80
- 'po###atapps.com':80
- 'sn###opping.com':80
- 'sl##a.bg':80
- 'ge#####alidental.com':80
- 'qi####ousheying.com':80
- 'it##.biz':80
- 'mu###rucks.com':80
- 'ke####haphat.com':80
- 'jq###ycare.com':80
- 'ru###dudak.com':80
- 'ku###-trans.com':80
- 'sv##te.cat':80
- 'pa###aoibf.com':80
- 'ra##u.net':80
- 'ip##ddr.es':80
- 'my####rnalip.com':80
- 'cu###yip.com':80
- 'la#####rnetdanang.com':80
- 'bp###uli.org':80
- 'av###gasten.com':80
- 'je#######ce.zawiercie.powiat.pl':80
- 'd-###music.com':80
- 'sa##krk.com':80
- 'sc###yllc.com':80
- 'ha##c.gr':80
TCP:
HTTP GET requests:
- http://cu###yip.com/
- http://my####rnalip.com/raw
- http://ip##ddr.es/
HTTP POST requests:
- http://me###g.com.br/wp-content/ap5.php?f=##############
- http://te###turk.com/wp-content/plugins/wp-db-backup-made/ap5.php?o=##############
- http://sl##a.bg/administrator/components/com_joomlaupdate/ap4.php?p=##############
- http://sn###opping.com/cache/ap2.php?j=##############
- http://la####sinhvien.net/wp-content/plugins/better-wp-security/modules/free/brute-force/js/ap3.php?m=##############
- http://ad###walk.com/cache/ap5.php?y=##############
- http://ke####haphat.com/wp-content/plugins/revslider/css/jui/new/images/ap2.php?s=##############
- http://ge#####alidental.com/wp-content/plugins/wp-db-backup-made/ap3.php?z=##############
- http://qi####ousheying.com/wp-content/plugins/wp-db-backup-made/ap3.php?u=##############
- http://it##.biz/wp-content/plugins/social-locker/panda-items/social-locker/admin/metaboxes/ap4.php?b=##############
- http://jq###ycare.com/wp-content/themes/twentythirteen/ap4.php?h=##############
- http://ru###dudak.com/wp-content/themes/imagazine/images/social/3/24/ap5.php?q=##############
- http://mu###rucks.com/wp-content/plugins/wpclef/assets/src/sass/bourbon/ap1.php?n=##############
- http://po###atapps.com/wp-content/themes/asteria-lite/redux/assets/css/vendor/ap2.php?u=##############
- http://pa###aoibf.com/images/stories/ap1.php?a=##############
- http://la#####rnetdanang.com/wp-content/plugins/jetpack/modules/widgets/gallery/css/ap4.php?z=##############
- http://sa##krk.com/wp-content/plugins/wp-db-backup-made/ap4.php?m=##############
- http://ra##u.net/old/wp-content/plugins/wordbook/facebook-platform/php/jsonwrapper/ap2.php?t=##############
- http://ku###-trans.com/wp-content/plugins/wp-db-backup-made/ap5.php?v=##############
- http://sv##te.cat/ap1.php?c=##############
- http://sc###yllc.com/wp-content/themes/twentytwelve/ap1.php?p=##############
- http://av###gasten.com/wp-content/plugins/wp-db-backup-made/ap1.php?r=##############
- http://je#######ce.zawiercie.powiat.pl/config/ap1.php?q=##############
- http://li####llardemo.net/wp-content/plugins/wp-db-backup-made/ap4.php?g=##############
- http://ha##c.gr/wp-content/ap3.php?j=##############
- http://d-###music.com/wp-content/plugins/wp-db-backup-made/ap3.php?c=##############
- http://bp###uli.org/wp-content/plugins/wp-db-backup-made/ap2.php?l=##############
UDP:
- DNS ASK ad###walk.com
- DNS ASK me###g.com.br
- DNS ASK te###turk.com
- DNS ASK la####sinhvien.net
- DNS ASK li####llardemo.net
- DNS ASK po###atapps.com
- DNS ASK sn###opping.com
- DNS ASK sl##a.bg
- DNS ASK ge#####alidental.com
- DNS ASK qi####ousheying.com
- DNS ASK it##.biz
- DNS ASK mu###rucks.com
- DNS ASK ke####haphat.com
- DNS ASK jq###ycare.com
- DNS ASK ru###dudak.com
- DNS ASK ku###-trans.com
- DNS ASK sv##te.cat
- DNS ASK pa###aoibf.com
- DNS ASK ra##u.net
- DNS ASK ip##ddr.es
- DNS ASK my####rnalip.com
- DNS ASK cu###yip.com
- DNS ASK la#####rnetdanang.com
- DNS ASK bp###uli.org
- DNS ASK av###gasten.com
- DNS ASK je#######ce.zawiercie.powiat.pl
- DNS ASK d-###music.com
- DNS ASK sa##krk.com
- DNS ASK sc###yllc.com
- DNS ASK ha##c.gr
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''