Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'imapi.exe' = '%APPDATA%\Mozilla\eventcreate.exe'
Malicious functions:
Injects code into
the following system processes:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\cscript.exe
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\ctfmon.exe
a large number of user processes.
Terminates or attempts to terminate
the following user processes:
- safari.exe
- opera.exe
- chrome.exe
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000003'
Modifies file system:
Creates the following files:
- %APPDATA%\Mozilla\eventcreate.exe
Deletes itself.
Network activity:
Connects to:
- 'l9#####y5xk.ezootoo.su':443
- 'o1######11oyhi.ezootoo.su':443
- '71######hfutpdw2.ezootoo.su':443
- 'sz######mxewd.www5.nmbc.cc':443
- 'p8######kvlv3pv3v.nmbc.cc':443
- '2k#####bb.ezootoo.su':443
- 'b1######7.www5.ezootoo.su':443
- 'js#####mk7.oogagh.su':443
UDP:
- DNS ASK lf######5nwf3.ezootoo.su
- DNS ASK v8######ynk25u.ezootoo.su
- DNS ASK gi######c.www5.ezootoo.su
- DNS ASK 7v######5n40vh0.oogagh.su
- DNS ASK q0######jbkh00br.oogagh.su
- DNS ASK d8######2p3bfiu.oogagh.su
- DNS ASK hy######v8283s.oogagh.su
- DNS ASK cj####iw3b.nmbc.cc
- DNS ASK ql######zq4nu6h.oogagh.su
- DNS ASK n4#######kcfboq.www5.nmbc.cc
- DNS ASK zy#######5chskp3.www5.oogagh.su
- DNS ASK oh#####8686p8.nmbc.cc
- DNS ASK b1######7.www5.ezootoo.su
- DNS ASK o1######11oyhi.ezootoo.su
- DNS ASK l9#####y5xk.ezootoo.su
- DNS ASK 2k#####bb.ezootoo.su
- DNS ASK p8######kvlv3pv3v.nmbc.cc
- DNS ASK js#####mk7.oogagh.su
- DNS ASK 9z######kbpfq9mnq6.nmbc.cc
- DNS ASK 2z#####o.www5.oogagh.su
- DNS ASK p2####yc.nmbc.cc
- DNS ASK sz######mxewd.www5.nmbc.cc
- DNS ASK 71######hfutpdw2.ezootoo.su
- DNS ASK a0####dxu.nmbc.cc