Technical Information
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies settings of Windows Internet Explorer
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1C00' = '{00,00,00,00}'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'CurrentLevel' = '{00,00,00,00}'
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyServer' = '127.0.0.1:9666'
- [<HKCU>\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '127.0.0.1'
Modifies file system
Creates the following files
- <Current directory>\utmp\~pbpgxeidmii7w5s
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\a0ggj0wy\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\60fomkr9\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\c21epyiv\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\bwes6ljs\desktop.ini
- %HOMEPATH%\putty.rnd
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- <Current directory>\utmp\~qjcdjcthztd8d6r
- <Current directory>\utmp\~nhevdxjgsji8a7e
- <Current directory>\utmp\~kfmebhwzmwf7v6a
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- <Current directory>\utmp\~iabtanxcnxf8h9u
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\bwes6ljs\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\c21epyiv\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\60fomkr9\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\a0ggj0wy\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
Network activity
Connects to
- 'google.com':80
- '21#.#4.110.97':443
- '12#.#30.9.203':443
- '11#.#4.61.217':443
- '12.##3.224.80':443
- '19#.#89.112.158':443
- '17#.#80.215.100':443
- 'go##le.dk':80
- 'go##le.us':80
- '11#.#4.58.13':443
- 'go##le.no':80
- 'go###e.co.ck':80
- 'go##le.fi':80
- 's3.###zonaws.com':443
- 'localhost':9666
- 'co#####2cn.dev.java.net':443
- '65.#9.14.12':443
- '65.#9.14.54':443
- '65.#9.14.86':443
- 'go##le.net':80
- '12#.#22.129.163':443
TCP
HTTP GET requests
- http://20#.#5.233.104/gwt/n?u=##################################################################################
- http://64.##3.164.104/gwt/n?u=##########################################################################
- http://17#.#94.73.94/gwt/n?u=###########################################################################
- http://64.##3.164.147/gwt/n?u=#######################################################################
- http://64.##3.164.104/gwt/n?u=#########################################################################
- http://64.##3.161.94/gwt/n?u=#####################################################################
UDP
- DNS ASK cb##x.info
- DNS ASK google.com
- DNS ASK wu##.###bryxf.wlzqpcm.info
- DNS ASK wu##.####ryxf.upwbghxdg.info
- DNS ASK wu##.###bryxf.hldpiz.info
- DNS ASK co#####2cn.dev.java.net
- DNS ASK et####.smartfp.com.tw
- DNS ASK s3.###zonaws.com
- DNS ASK go###e.co.ck
- DNS ASK go##le.fi
- DNS ASK go##le.net
- DNS ASK go##le.no
- DNS ASK go##le.us
- DNS ASK go##le.dk
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
