Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d9' = '%APPDATA%\1e6f17d9.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d' = 'C:\1e6f17d9\1e6f17d9.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\1e6f17d9.exe
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
Executes the following:
- '<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet
- '<SYSTEM32>\svchost.exe' netsvcs
- '%WINDIR%\explorer.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system :
Creates the following files:
- %APPDATA%\1e6f17d9.exe
- C:\1e6f17d9\1e6f17d9.exe
Network activity:
Connects to:
- 'ye###ouse.com':80
- 'mo####fromspain.com':80
- 'st##ena.ru':80
- 'un###uified.com':80
- 'no#####ltipropiedad.com':80
- 'ni####evolved.com':80
- 'al######gasurvivalgear.com':80
- 'ts###dal.com':80
- 'sp####stache.com':80
- 'pa###aina.ru':80
- 'vi####anservisi.com':80
- 'pr##soya.ru':80
- 'we######ngnursesource.com':80
- 'gu####ekorasyon.com':80
- 'sw###babes.ru':80
- 'co###hep.com':80
- 'fo####nnecting.com':80
- 'do####-capital.info':80
- 'vo###metmoi.com':80
- 'ag####etcorp.com':80
- 'sl#.it':80
- 'be######osting-smart.com':80
- 'in####llions.com':80
- 'rh#######supplierkosmetik.com':80
- 'bi####tgiveaway.com':80
- 'sa#####faototamir.com':80
- 'be###urs.com':80
- 'my####rnalip.com':80
- 'ip##ddr.es':80
- 'cu###yip.com':80
- 'os####mobilien.com':80
- 'vd##58.ru':80
- 'gr####zero360.org':80
- 'mo####kechar.com':80
- 'st####arbrand.co':80
- 'ta#####s-in-arnhem.nl':80
- 'so######using.modulo.net':80
- 'mo###ser.com':80
- 'ho#########cocainestayinyoursystem.org':80
- 'bi###netweb.com':80
- 'th####meindex.com':80
- 've#####cipesworld.com':80
- 'sh###ingcm.com':80
TCP:
HTTP GET requests:
- http://cu###yip.com/
- http://my####rnalip.com/raw
- http://ip##ddr.es/
HTTP POST requests:
- http://st##ena.ru/wp-content/plugins/fusion-core/admin/page-builder/assets/fonts/fonts/5.php?g=##############
- http://ye###ouse.com/wp-content/themes/contango/lib/js/superfish/4.php?r=##############
- http://no#####ltipropiedad.com/wp-content/plugins/security-ninja-core-scanner-addon/documentation/assets/blueprint-css/plugins/fancy-type/3.php?n=##############
- http://vi####anservisi.com/wp-content/themes/perspectivewp/functions/pagebuilder/functions/metaboxes/js/2.php?r=##############
- http://un###uified.com/wp-content/themes/flexform/includes/page-builder/composer/lib/shortcodes/3.php?f=##############
- http://ts###dal.com/wp-content/themes/skylab/option-tree/assets/images/layout/2.php?z=##############
- http://ni####evolved.com/wp-content/plugins/easyblogging/themes/stripes_orange/assets/icons/theme_icons/5.php?z=##############
- http://pa###aina.ru/wp-includes/js/tinymce/themes/advanced/skins/wp_theme/img/4.php?f=##############
- http://mo####fromspain.com/wp-content/themes/diva-final/assets/bootstrap-master/docs/examples/starter-template/4.php?e=##############
- http://sp####stache.com/wp-content/uploads/gravity_forms/1-7a320e64883203f22a4e76de83776fc3/tmp/2.php?f=##############
- http://pr##soya.ru/fancybox/__pages_sources/2.php?l=##############
- http://we######ngnursesource.com/wp-content/themes/epic/inc/ReduxFramework/ReduxCore/assets/css/5.php?c=##############
- http://gu####ekorasyon.com/wp-content/themes/rttheme18/js/lightbox/img/graphics/retina/5.php?d=##############
- http://sw###babes.ru/catalog/view/theme/beamstore/skins/store_default/Watches/js/5.php?k=##############
- http://co###hep.com/articles/_thumbs/Images/2/3.php?m=##############
- http://fo####nnecting.com/wp-content/plugins/easy-contact-forms/js/tinymce/themes/advanced/skins/4.php?q=##############
- http://do####-capital.info/wp-content/plugins/growposition/phpseclib0.2.2/PHP/Compat/Function/5.php?w=##############
- http://vo###metmoi.com/wp-includes/js/tinymce/plugins/compat3x/css/5.php?e=##############
- http://ag####etcorp.com/components/com_phocaguestbook/assets/library/standalone/HTMLPurifier/DefinitionCache/Serializer/CSS/2.php?k=##############
- http://sl#.it/wp-content/upgrade/wp-maintenance-mode.tmp/wp-maintenance-mode/assets/images/.X1-unix/de1/4.php?d=##############
- http://sa#####faototamir.com/wp-content/plugins/simple-tags/assets/js/lib/jquery.autocomplete/4.php?m=##############
- http://be###urs.com/it/wp-content/plugins/js_composer/include/templates/params/column_offset/3.php?o=##############
- http://gr####zero360.org/wp-content/uploads/2014/04/4.php?m=##############
- http://ho#########cocainestayinyoursystem.org/wp-content/plugins/backupbuddy/destinations/sftp/lib/phpseclib/File/3.php?e=##############
- http://bi###netweb.com/casper/wp-content/themes/envision-parent/framework/extensions/reservationform/config/3.php?v=##############
- http://os####mobilien.com/wp-content/themes/manchester/blueprint/extensions/options-framework/images/colorpicker/5.php?g=##############
- http://vd##58.ru/phpshop/admpanel/editor3/scripts/moz/icons/russian/5.php?w=##############
- http://rh#######supplierkosmetik.com/wp-content/plugins/wordpress-seo/vendor/composer/installers/tests/Composer/4.php?g=##############
- http://bi####tgiveaway.com/wp-content/plugins/js_composer/inline/assets/vc/social/tw/3.php?v=##############
- http://in####llions.com/wp-content/uploads/js_composer/.X1-unix/03a/2.php?q=##############
- http://mo###ser.com/wp-content/plugins/wordpress-backup-to-dropbox/Dropbox/Dropbox/OAuth/Consumer/5.php?g=##############
- http://ta#####s-in-arnhem.nl/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/mvc/templates/5.php?j=##############
- http://so######using.modulo.net/wp-content/uploads/gravity_forms/1-030f8fd0723e0cf70769a201fdd11b75/tmp/2.php?s=##############
- http://al######gasurvivalgear.com/wp-content/plugins/js_composer/assets/lib/bower/vcIconPicker/css/4.php?k=##############
- http://be######osting-smart.com/wp-content/themes/blogolife/functions/be/images/icons/4.php?a=##############
- http://sh###ingcm.com/wp-content/plugins/contact-form-lite/inc/css/formbuilder/vendor/fonts/3.php?p=##############
- http://th####meindex.com/wp-content/themes/ublog/options/ReduxCore/inc/validation/preg_replace/2.php?k=##############
- http://ve#####cipesworld.com/wp-content/plugins/ultimate-product-catalogue/PHPExcel/Classes/PHPExcel/locale/de/5.php?w=##############
- http://mo####kechar.com/fichiers/apps/files_pdfviewer/vendor/pdfjs/web/locale/my/4.php?h=##############
- http://st####arbrand.co/wp-content/plugins/better-wp-security/modules/free/away-mode/css/smoothness/5.php?v=##############
UDP:
- DNS ASK ye###ouse.com
- DNS ASK mo####fromspain.com
- DNS ASK st##ena.ru
- DNS ASK un###uified.com
- DNS ASK no#####ltipropiedad.com
- DNS ASK ni####evolved.com
- DNS ASK al######gasurvivalgear.com
- DNS ASK ts###dal.com
- DNS ASK sp####stache.com
- DNS ASK pa###aina.ru
- DNS ASK vi####anservisi.com
- DNS ASK pr##soya.ru
- DNS ASK we######ngnursesource.com
- DNS ASK gu####ekorasyon.com
- DNS ASK sw###babes.ru
- DNS ASK co###hep.com
- DNS ASK fo####nnecting.com
- DNS ASK do####-capital.info
- DNS ASK vo###metmoi.com
- DNS ASK ag####etcorp.com
- DNS ASK sl#.it
- DNS ASK be######osting-smart.com
- DNS ASK in####llions.com
- DNS ASK rh#######supplierkosmetik.com
- DNS ASK bi####tgiveaway.com
- DNS ASK sa#####faototamir.com
- DNS ASK be###urs.com
- DNS ASK my####rnalip.com
- DNS ASK ip##ddr.es
- DNS ASK cu###yip.com
- DNS ASK os####mobilien.com
- DNS ASK vd##58.ru
- DNS ASK gr####zero360.org
- DNS ASK mo####kechar.com
- DNS ASK st####arbrand.co
- DNS ASK ta#####s-in-arnhem.nl
- DNS ASK so######using.modulo.net
- DNS ASK mo###ser.com
- DNS ASK ho#########cocainestayinyoursystem.org
- DNS ASK bi###netweb.com
- DNS ASK th####meindex.com
- DNS ASK ve#####cipesworld.com
- DNS ASK sh###ingcm.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''