Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt] 'DLLName' = 'crypts.dll'
Malicious functions:
Injects code into
the following system processes:
- %WINDIR%\Explorer.EXE
Modifies file system :
Creates the following files:
- %TEMP%\F360.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[20].php
- %TEMP%\EB90.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[20].php
- %TEMP%\15A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[21].php
- %TEMP%\FA55.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[19].php
- %TEMP%\D5F4.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[19].php
- %TEMP%\DC7C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[20].php
- %TEMP%\E48B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[20].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[21].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[22].php
- %TEMP%\2889.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[22].php
- %TEMP%\303A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[23].php
- %TEMP%\3887.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[22].php
- %TEMP%\10BB.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[21].php
- %TEMP%\8DC.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[21].php
- %TEMP%\204C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[22].php
- %TEMP%\18AA.tmp
- %TEMP%\CF0F.tmp
- %TEMP%\82F2.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[16].php
- %TEMP%\7B22.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[17].php
- %TEMP%\9215.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[17].php
- %TEMP%\8AA3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[16].php
- %TEMP%\6529.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[15].php
- %TEMP%\6BF0.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[16].php
- %TEMP%\7343.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[16].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[17].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[18].php
- %TEMP%\B8A8.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[18].php
- %TEMP%\C098.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[19].php
- %TEMP%\C7AC.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[19].php
- %TEMP%\A167.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[17].php
- %TEMP%\9A05.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[18].php
- %TEMP%\B0F8.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[18].php
- %TEMP%\A8BA.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[28].php
- %TEMP%\C98C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[27].php
- %TEMP%\CFF4.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[28].php
- %TEMP%\D5F0.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[28].php
- %TEMP%\B558.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[27].php
- %TEMP%\AE91.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[27].php
- %TEMP%\C2F4.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[27].php
- %TEMP%\BBE0.tmp
- %TEMP%\DC58.tmp
- %TEMP%\FBF6.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[29].php
- %TEMP%\F58D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[30].php
- %TEMP%\A00.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[30].php
- %TEMP%\2EB.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[29].php
- %TEMP%\E32E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[28].php
- %TEMP%\E9A6.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[29].php
- %TEMP%\EFA2.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[29].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[26].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[24].php
- %TEMP%\5EBC.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[24].php
- %TEMP%\65B1.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[24].php
- %TEMP%\6C39.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[24].php
- %TEMP%\4950.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[23].php
- %TEMP%\4103.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[23].php
- %TEMP%\5798.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[23].php
- %TEMP%\5074.tmp
- %TEMP%\734E.tmp
- %TEMP%\96E3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[26].php
- %TEMP%\905B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[26].php
- %TEMP%\A664.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[26].php
- %TEMP%\9F4F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[25].php
- %TEMP%\7A72.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[25].php
- %TEMP%\8119.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[25].php
- %TEMP%\88F8.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[25].php
- %TEMP%\5DC7.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[5].php
- %TEMP%\2892.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[5].php
- %TEMP%\3043.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[6].php
- %TEMP%\3777.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[6].php
- %TEMP%\12F7.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[4].php
- %TEMP%\B18.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[5].php
- %TEMP%\2084.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[5].php
- %TEMP%\19BE.tmp
- %TEMP%\3E2E.tmp
- %TEMP%\634A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[7].php
- %TEMP%\5BC8.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[7].php
- %TEMP%\721F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[8].php
- %TEMP%\69F1.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[6].php
- %TEMP%\461D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[6].php
- %TEMP%\4D9F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[7].php
- %TEMP%\54C3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[7].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[4].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[2].php
- %TEMP%\AECF.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[1].php
- %TEMP%\B9CB.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[2].php
- %TEMP%\C1F9.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[2].php
- %TEMP%\8638.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[1].php
- <SYSTEM32>\crypts.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[1].php
- %TEMP%\A44F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[1].php
- %TEMP%\9924.tmp
- %TEMP%\CA36.tmp
- %TEMP%\F33A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[3].php
- %TEMP%\EB1C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[4].php
- %TEMP%\3B5.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[4].php
- %TEMP%\FB78.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[3].php
- %TEMP%\D245.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[2].php
- %TEMP%\DA72.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[3].php
- %TEMP%\E2DF.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[3].php
- %TEMP%\138F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[13].php
- %TEMP%\B61.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[13].php
- %TEMP%\2254.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[13].php
- %TEMP%\1B8E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[12].php
- %TEMP%\F307.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[12].php
- %TEMP%\FB25.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[12].php
- %TEMP%\372.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[12].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[13].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[15].php
- %TEMP%\4899.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[14].php
- %TEMP%\5059.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[15].php
- %TEMP%\576E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[15].php
- %TEMP%\3187.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[14].php
- %TEMP%\29E5.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[14].php
- %TEMP%\40F8.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[14].php
- %TEMP%\39C4.tmp
- %TEMP%\EAD9.tmp
- %TEMP%\9B13.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[9].php
- %TEMP%\92B6.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[9].php
- %TEMP%\AB5F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[9].php
- %TEMP%\A341.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[8].php
- %TEMP%\7A5C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[8].php
- %TEMP%\827A.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[9].php
- %TEMP%\8A89.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[8].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[10].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[11].php
- %TEMP%\D25F.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\bt[11].php
- %TEMP%\DA5E.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[11].php
- %TEMP%\E2F9.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[11].php
- %TEMP%\BB7C.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bt[10].php
- %TEMP%\B37D.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bt[10].php
- %TEMP%\CB3B.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\bt[10].php
- %TEMP%\C37B.tmp
Deletes the following files:
- %TEMP%\F360.tmp
- %TEMP%\FA55.tmp
- %TEMP%\15A.tmp
- %TEMP%\EB90.tmp
- %TEMP%\D5F4.tmp
- %TEMP%\DC7C.tmp
- %TEMP%\E48B.tmp
- %TEMP%\2889.tmp
- %TEMP%\303A.tmp
- %TEMP%\3887.tmp
- %TEMP%\204C.tmp
- %TEMP%\8DC.tmp
- %TEMP%\10BB.tmp
- %TEMP%\18AA.tmp
- %TEMP%\CF0F.tmp
- %TEMP%\82F2.tmp
- %TEMP%\8AA3.tmp
- %TEMP%\9215.tmp
- %TEMP%\7B22.tmp
- %TEMP%\6529.tmp
- %TEMP%\6BF0.tmp
- %TEMP%\7343.tmp
- %TEMP%\B8A8.tmp
- %TEMP%\C098.tmp
- %TEMP%\C7AC.tmp
- %TEMP%\B0F8.tmp
- %TEMP%\9A05.tmp
- %TEMP%\A167.tmp
- %TEMP%\A8BA.tmp
- %TEMP%\4103.tmp
- %TEMP%\CFF4.tmp
- %TEMP%\D5F0.tmp
- %TEMP%\DC58.tmp
- %TEMP%\C98C.tmp
- %TEMP%\B558.tmp
- %TEMP%\BBE0.tmp
- %TEMP%\C2F4.tmp
- %TEMP%\FBF6.tmp
- %TEMP%\2EB.tmp
- %TEMP%\A00.tmp
- %TEMP%\F58D.tmp
- %TEMP%\E32E.tmp
- %TEMP%\E9A6.tmp
- %TEMP%\EFA2.tmp
- %TEMP%\AE91.tmp
- %TEMP%\65B1.tmp
- %TEMP%\6C39.tmp
- %TEMP%\734E.tmp
- %TEMP%\5EBC.tmp
- %TEMP%\4950.tmp
- %TEMP%\5074.tmp
- %TEMP%\5798.tmp
- %TEMP%\96E3.tmp
- %TEMP%\9F4F.tmp
- %TEMP%\A664.tmp
- %TEMP%\905B.tmp
- %TEMP%\7A72.tmp
- %TEMP%\8119.tmp
- %TEMP%\88F8.tmp
- %TEMP%\3043.tmp
- %TEMP%\3777.tmp
- %TEMP%\3E2E.tmp
- %TEMP%\2892.tmp
- %TEMP%\12F7.tmp
- %TEMP%\19BE.tmp
- %TEMP%\2084.tmp
- %TEMP%\634A.tmp
- %TEMP%\69F1.tmp
- %TEMP%\721F.tmp
- %TEMP%\5BC8.tmp
- %TEMP%\461D.tmp
- %TEMP%\4D9F.tmp
- %TEMP%\54C3.tmp
- %TEMP%\B18.tmp
- %TEMP%\B9CB.tmp
- %TEMP%\C1F9.tmp
- %TEMP%\CA36.tmp
- %TEMP%\AECF.tmp
- %TEMP%\8638.tmp
- %TEMP%\9924.tmp
- %TEMP%\A44F.tmp
- %TEMP%\F33A.tmp
- %TEMP%\FB78.tmp
- %TEMP%\3B5.tmp
- %TEMP%\EB1C.tmp
- %TEMP%\D245.tmp
- %TEMP%\DA72.tmp
- %TEMP%\E2DF.tmp
- %TEMP%\7A5C.tmp
- %TEMP%\1B8E.tmp
- %TEMP%\2254.tmp
- %TEMP%\29E5.tmp
- %TEMP%\138F.tmp
- %TEMP%\FB25.tmp
- %TEMP%\372.tmp
- %TEMP%\B61.tmp
- %TEMP%\5059.tmp
- %TEMP%\576E.tmp
- %TEMP%\5DC7.tmp
- %TEMP%\4899.tmp
- %TEMP%\3187.tmp
- %TEMP%\39C4.tmp
- %TEMP%\40F8.tmp
- %TEMP%\F307.tmp
- %TEMP%\A341.tmp
- %TEMP%\AB5F.tmp
- %TEMP%\B37D.tmp
- %TEMP%\9B13.tmp
- %TEMP%\827A.tmp
- %TEMP%\8A89.tmp
- %TEMP%\92B6.tmp
- %TEMP%\DA5E.tmp
- %TEMP%\E2F9.tmp
- %TEMP%\EAD9.tmp
- %TEMP%\D25F.tmp
- %TEMP%\BB7C.tmp
- %TEMP%\C37B.tmp
- %TEMP%\CB3B.tmp
Network activity:
Connects to:
- 'df###cfaaf.com':80
- 'ef#####cdfddfbda.com':80
- 'fb####bafaecfb.com':80
- 'localhost':1036
- 'fb####fbdede.com':80
TCP:
HTTP GET requests:
- df###cfaaf.com/bt.php?mo##############################################
- ef#####cdfddfbda.com/bt.php?mo##############################################
- fb####fbdede.com/bt.php?mo##############################################
- fb####bafaecfb.com/bt.php?mo##############################################
UDP:
- DNS ASK df###cfaaf.com
- DNS ASK ef#####cdfddfbda.com
- DNS ASK fb####fbdede.com
- DNS ASK fb####bafaecfb.com
