Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'CryptoLocker' = '"%APPDATA%\Jmhskctribudntf.exe"'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\Jmhskctribudntf.exe' /w0000007C
- '%APPDATA%\Jmhskctribudntf.exe' "/r<Full path to virus>"
Modifies file system :
Creates the following files:
- %TEMP%\KCE3205.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\home[1].htm
- %TEMP%\UNN2A59.tmp
- %TEMP%\YYEB09B.tmp
- %APPDATA%\Jmhskctribudntf.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\Jmhskctribudntf.exe
Deletes the following files:
- %TEMP%\KCE3205.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\home[1].htm
- %TEMP%\YYEB09B.tmp
- %TEMP%\UNN2A59.tmp
Deletes itself.
Network activity:
Connects to:
- 'hj####skpvok.biz':80
- 'bw####waqgvo.net':80
- 'jk####nuuhyx.org':80
- 'ut###rfqjsge.ru':80
- 'll####pjrxth.co.uk':80
- 'ds####hcvker.org':80
- 'nm####ktwjeu.com':80
- 'yv####cplulb.info':80
- 'pc###xsasdew.ru':80
- 'wb####uktcys.biz':80
- 'rd####nkxook.co.uk':80
- 'qx####dbmoji.org':80
- 'te####pyufjt.info':80
- 'wu####aboeqr.co.uk':80
- 'vf####kjaqth.net':80
- 'ua####aaoqof.com':80
- 'sa####sfuuvs.com':80
- 'lq####gfuqkc.info':80
- 'te####ndcxjt.biz':80
- 'gk####oillre.net':80
- 'wc###ppewwbp.ru':80
- 'kh####vjbyjb.biz':80
- 'xg####kceaoq.co.uk':80
- 'km####lhnnwb.org':80
- 'bs####sjxcpw.net':80
- 'hu####ebxmjo.com':80
- 'cw###fnhffdx.ru':80
- 'co####meohqq.biz':80
- 'fu####piaeut.org':80
- 'ho###cjgsoff.ru':80
- 'gy####kghhiu.info':80
- 'gq####jdqjvn.co.uk':80
UDP:
- DNS ASK ut###rfqjsge.ru
- DNS ASK hj####skpvok.biz
- DNS ASK wu####aboeqr.co.uk
- DNS ASK jk####nuuhyx.org
- DNS ASK yv####cplulb.info
- DNS ASK ll####pjrxth.co.uk
- DNS ASK bw####waqgvo.net
- DNS ASK nm####ktwjeu.com
- DNS ASK qx####dbmoji.org
- DNS ASK pc###xsasdew.ru
- DNS ASK sy####xlratv.info
- DNS ASK rd####nkxook.co.uk
- DNS ASK ua####aaoqof.com
- DNS ASK te####pyufjt.info
- DNS ASK wb####uktcys.biz
- DNS ASK vf####kjaqth.net
- DNS ASK ds####hcvker.org
- DNS ASK sa####sfuuvs.com
- DNS ASK lq####gfuqkc.info
- DNS ASK te####ndcxjt.biz
- DNS ASK gk####oillre.net
- DNS ASK wc###ppewwbp.ru
- DNS ASK kh####vjbyjb.biz
- DNS ASK xg####kceaoq.co.uk
- DNS ASK km####lhnnwb.org
- DNS ASK bs####sjxcpw.net
- DNS ASK hu####ebxmjo.com
- DNS ASK cw###fnhffdx.ru
- DNS ASK co####meohqq.biz
- DNS ASK fu####piaeut.org
- DNS ASK ho###cjgsoff.ru
- DNS ASK gy####kghhiu.info
- DNS ASK gq####jdqjvn.co.uk
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: '(null)'
