Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'F1SNsvF4j3Qpz13oCVbfFCWgKw==' = '"%APPDATA%\Mozilla\Firefox\cipher.exe"'
Malicious functions:
Injects code into
the following system processes:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\cscript.exe
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\ctfmon.exe
a large number of user processes.
Terminates or attempts to terminate
the following user processes:
- safari.exe
- opera.exe
- chrome.exe
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000003'
Modifies file system :
Creates the following files:
- %APPDATA%\Mozilla\Firefox\cipher.exe
Deletes itself.
Network activity:
Connects to:
- '8l#####9g6zp9.umc.su':443
- '31#######87xy5kg.www5.umc.su':443
- 'rf#####i7d6r3.jeo.cc':443
- 'n0#####17kxf5cqo.umc.su':443
- 'fd####g8rl.jeo.cc':443
- 'bf####3ol.umc.su':443
- 'v7#####qvfuumw.umc.su':443
- 'o1####gcvnb.gmz.cc':443
UDP:
- DNS ASK c3####16q.umc.su
- DNS ASK u7####.www5.gmz.cc
- DNS ASK k8####84c4.gmz.cc
- DNS ASK m3#####p7kzbj5az.jeo.cc
- DNS ASK 5q#######gn8t3d8g.www5.jeo.cc
- DNS ASK 4f######ihnwz81tt.umc.su
- DNS ASK dr######7fmihqecjo.gmz.cc
- DNS ASK 37#####wrgq.www5.umc.su
- DNS ASK tw###n.jeo.cc
- DNS ASK vq####9qboa.gmz.cc
- DNS ASK 1m#####5bye25l40.umc.su
- DNS ASK hs#####ttztaz.gmz.cc
- DNS ASK cn###h9.gmz.cc
- DNS ASK 9t#####8qmv8vu.jeo.cc
- DNS ASK 10####qx6.jeo.cc
- DNS ASK 0q###wc.jeo.cc
- DNS ASK w3#####8z3p0r.umc.su
- DNS ASK hy###tk.umc.su
- DNS ASK kh####mq0dnu.gmz.cc
- DNS ASK 62#####opqd9381x.jeo.cc
- DNS ASK n0#####17kxf5cqo.umc.su
- DNS ASK 8l#####9g6zp9.umc.su
- DNS ASK 0s#####cz7.www5.jeo.cc
- DNS ASK rf#####i7d6r3.jeo.cc
- DNS ASK 31#######87xy5kg.www5.umc.su
- DNS ASK fd####g8rl.jeo.cc
- DNS ASK bf####3ol.umc.su
- DNS ASK v7#####qvfuumw.umc.su
- DNS ASK o1####gcvnb.gmz.cc
- DNS ASK cn#####kps58dx.jeo.cc
- DNS ASK t8####vpx41.jeo.cc
- DNS ASK bs###dej.umc.su
- DNS ASK y4####27c5.umc.su
- DNS ASK pg#####xnv4h5.gmz.cc
- DNS ASK 2q#####5inkt4.gmz.cc
- DNS ASK 9u###wrk.gmz.cc
- DNS ASK xq#####stb08kn.jeo.cc
- DNS ASK 2b#####n82sxiu.gmz.cc
- DNS ASK 6l######kn707u8.www5.gmz.cc
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
