Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_regiis.exe
Patches code
in dll
- unmcg.exe process, KERNEL32.dll module
Modifies file system
Creates the following files
- %APPDATA%\gdi.dll
Sets the 'hidden' attribute to the following files
- %APPDATA%\gdi.dll
Network activity
Connects to
- 're###epart.biz':443
- 'x1.#.lencr.org':80
- 're###tebhu.sbs':443
- 'no#####fpleadings.net':443
- 'th###yyokej.sbs':443
- 'du###ringjk.sbs':443
- 'ex###invees.sbs':443
- 'ro###eud.sbs':443
- 're###ingj.sbs':443
- 'ta###geesy.sbs':443
- 'st####ommunity.com':443
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 're###epart.biz':443
- 'br###ieyuz.sbs':443
- 'no#####fpleadings.net':443
- 'st####ommunity.com':443
UDP
- DNS ASK re###epart.biz
- DNS ASK x1.#.lencr.org
- DNS ASK re###tebhu.sbs
- DNS ASK no#####fpleadings.net
- DNS ASK th###yyokej.sbs
- DNS ASK du###ringjk.sbs
- DNS ASK ex###invees.sbs
- DNS ASK br###ieyuz.sbs
- DNS ASK ro###eud.sbs
- DNS ASK re###ingj.sbs
- DNS ASK ta###geesy.sbs
- DNS ASK st####ommunity.com
Miscellaneous
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_regiis.exe'
