Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'xmkkxnh' = '<LS_APPDATA>\wavbgw.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\unmst.exe
Malicious functions:
Injects code into
the following system processes:
- %WINDIR%\Explorer.EXE
the following user processes:
- skype.exe
Modifies file system :
Creates the following files:
- <LS_APPDATA>\wavbgw.exe
Sets the 'hidden' attribute to the following files:
- <LS_APPDATA>\wavbgw.exe
- %HOMEPATH%\Start Menu\Programs\Startup\unmst.exe
Network activity:
Connects to:
- '16#.#11.144.67':80
- '16#.#11.144.43':80
- '16#.#11.144.31':80
- '16#.#11.144.59':80
- '16#.#11.144.19':80
- '16#.#11.144.36':80
- '16#.#11.144.48':80
- '16#.#11.144.34':80
- '16#.#11.144.6':80
- '16#.#11.144.37':80
TCP:
HTTP POST requests:
- 16#.#11.144.67/home.php
- 16#.#11.144.43/home.php
- 16#.#11.144.31/home.php
- 16#.#11.144.59/home.php
- 16#.#11.144.19/home.php
- 16#.#11.144.36/home.php
- 16#.#11.144.48/home.php
- 16#.#11.144.34/home.php
- 16#.#11.144.6/home.php
- 16#.#11.144.37/home.php
UDP:
- DNS ASK ye#.it
- DNS ASK aw#.sm
- DNS ASK cl###url.com
- DNS ASK ti##url.com
- DNS ASK co##rl.com
- DNS ASK al##rl.com
- DNS ASK bi###ink.com
- DNS ASK ti##link.me
- DNS ASK ta.gg
- DNS ASK ti###ink.com
- DNS ASK be#m.to
- DNS ASK de###turl.com
- DNS ASK ah##f.in
- DNS ASK sh###urli.com
- DNS ASK ca##rl.com
- DNS ASK li###ala.com
- DNS ASK ch##p.it
- DNS ASK ti#y.cc
- DNS ASK sh###urli.net
- DNS ASK ho###orturl.com
- DNS ASK bi#.ly
- DNS ASK ch####horturl.com
- DNS ASK wo#g.to
- DNS ASK ti###url.com
- DNS ASK di##.com
- DNS ASK a.#f
- DNS ASK is.gd
- DNS ASK ar#.in
- DNS ASK ff#.to
- DNS ASK b2#.ru
- DNS ASK cl#.gs
- DNS ASK db##st.de
- DNS ASK sh###url.info
- DNS ASK sh###link.se
- DNS ASK it#o.ws
- DNS ASK ti##link.in
- DNS ASK l9#.net
- DNS ASK di##ig.com
- DNS ASK do##p.com
- DNS ASK sh###urli.org
- DNS ASK d0#.me
- DNS ASK ti##link.ir
- DNS ASK bu##rl.com
- DNS ASK yo##ls.org
- DNS ASK ni##rl.com
- DNS ASK bu##url.com
- DNS ASK di##url.com
- DNS ASK mo.by
- DNS ASK b4##.net
- DNS ASK fh##l.com
- DNS ASK ti###ong.com
- DNS ASK ab##r.com
- DNS ASK cj#.net
- DNS ASK a.#d
- DNS ASK co##url.com
- DNS ASK aa##er.us
- DNS ASK su.pr
- DNS ASK yv#.me
- DNS ASK pr##ala.com
- DNS ASK ti###rrows.com
- DNS ASK re##r.ec
- DNS ASK ba#n.me
- DNS ASK ti###url.net
- DNS ASK ti###url.org
- DNS ASK co.nr
- DNS ASK sn#p.vu
- DNS ASK un###rten.com
- DNS ASK ab##.com
- DNS ASK go#.gl
- DNS ASK bl##t.me
- DNS ASK li###nti.com
- DNS ASK x.#u
- DNS ASK bi##y.com
- DNS ASK su#f.to
- DNS ASK df#8.me
- DNS ASK sh###switch.com
- DNS ASK du#l.us
- DNS ASK it#.im
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
