Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d9' = '%APPDATA%\1e6f17d9.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1e6f17d' = 'C:\1e6f17d9\1e6f17d9.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\1e6f17d9.exe
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
deletes volume shadow copies.
Executes the following:
- '<SYSTEM32>\svchost.exe' netsvcs
- '%WINDIR%\explorer.exe'
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system:
Creates the following files:
- %APPDATA%\1e6f17d9.exe
- C:\1e6f17d9\1e6f17d9.exe
Network activity:
Connects to:
- 'am###astyle.com':80
- 'ca####onmarket.com':80
- 'cr######travelandmore.com':80
- 'bi##al.com':80
- 'da#####ircuitbreaker.co':80
- 'da#######garciniacambogia.com':80
- 'al####dytravel.com':80
- 'ca###ate.com':80
- 'al#######siveresortstravel.com':80
- 'bo#####andfurnaces.com':80
- 'br###erhub.com':80
- 'an#####csteroidsrx.com':80
- 'cr#####ndtravel.agency':80
- 'da#####estaurant.com':80
- 'cr#####ravelpros.com':80
- 'br###egenie.com':80
- 'en####ealtyny.com':80
- 'ar####arzon.info':80
- 'cy###lness.com':80
- 'al####upstravel.com':80
- 'su####unshoes.com':80
- 'de######ruiseandtravel.com':80
- 'ci#####breakerhub.com':80
- 'be####ouseplans.com':80
- 'ap####chatudia.com':80
- 'cr####ngatdawn.com':80
- 'br######kingsolutions.com':80
- 'cr####withdawn.com':80
- 'de####brossard.com':80
- 'my####rnalip.com':80
- 'ip##ddr.es':80
- 'cu###yip.com':80
- 'da########nditionedtransformers.com':80
- 'de######gartinstitute.com':80
- 'co##bar.com':80
- 'be###iktas.com':80
- 'ab#####travelagent.com':80
- 'bi####ttravel.com':80
- 'ab#####travelagency.com':80
- 'ch####hitlock.com':80
- 'da######rcuitbreaker.com':80
- 'da######ectricalsurplus.com':80
- 'ca#####chambers.co.uk':80
- 'ta###hyainc.com':80
- 'an####amicasa.com':80
TCP:
HTTP GET requests:
- http://cu###yip.com/
- http://my####rnalip.com/raw
- http://ip##ddr.es/
HTTP POST requests:
- http://am###astyle.com/fr/wc-logs/f80PTG.php?v=##############
- http://ca####onmarket.com/wp-admin/includes/Ynr7Ek.php?u=##############
- http://cr######travelandmore.com/uploads/3/5/3/8/3538503/header_images/bwU1TO.php?v=##############
- http://bi##al.com/wp-includes/images/smilies/z43UNm.php?t=##############
- http://da#####ircuitbreaker.co/cgi-bin/1kS5Q8.php?p=##############
- http://al#######siveresortstravel.com/files/theme/wCM9gb.php?j=##############
- http://al####dytravel.com/uploads/3/5/4/9/3549731/header_images/ToMaE1.php?e=##############
- http://br###erhub.com/wp-includes/images/crystal/OKhW0f.php?e=##############
- http://da#######garciniacambogia.com/wp-content/plugins/w3-total-cache/wp-content/Dcr03q.php?d=##############
- http://bo#####andfurnaces.com/uploads/3/5/1/6/3516773/RPyH2q.php?p=##############
- http://cy###lness.com/wp-includes/ID3/YlWGg2.php?f=##############
- http://an#####csteroidsrx.com/wp-includes/fonts/nW8axr.php?i=##############
- http://cr#####ndtravel.agency/uploads/3/5/2/1/3521981/header_images/caeSXR.php?w=##############
- http://da#####estaurant.com/wp-includes/fonts/UJeXQV.php?t=##############
- http://cr#####ravelpros.com/uploads/3/5/6/9/3569932/xDvag4.php?d=##############
- http://br###egenie.com/wp-includes/css/bCL27P.php?l=##############
- http://al####upstravel.com/files/theme/XjRJIC.php?a=##############
- http://ar####arzon.info/202-Mobile/mini-stats/T7qPUQ.php?q=##############
- http://de######ruiseandtravel.com/wp-admin/network/0hQB5C.php?s=##############
- http://en####ealtyny.com/wp-admin/js/EdSDWF.php?k=##############
- http://su####unshoes.com/css/store/arKBF_.php?n=##############
- http://cr####withdawn.com/files/theme/lHU1wj.php?m=##############
- http://cr####ngatdawn.com/uploads/3/5/4/9/3549187/header_images/ohjUGA.php?x=##############
- http://br######kingsolutions.com/wp-includes/Text/Diff/Renderer/KQJlXE.php?k=##############
- http://da######rcuitbreaker.com/cgi-bin/_ctrz0.php?f=##############
- http://da######ectricalsurplus.com/wp-includes/images/crystal/RnsFwc.php?h=##############
- http://da########nditionedtransformers.com/wp-includes/js/tinymce/plugins/wpeditimage/fDQA4J.php?x=##############
- http://de######gartinstitute.com/wp-includes/ID3/AWxa5Y.php?t=##############
- http://de####brossard.com/old/wc-logs/GnMB1l.php?z=##############
- http://be####ouseplans.com/wp-admin/js/5d8gMe.php?j=##############
- http://ap####chatudia.com/wp-content/themes/twentyfourteen/page-templates/PpRNtA.php?a=##############
- http://ca#####chambers.co.uk/rHCxjD.php?p=##############
- http://ab#####travelagency.com/wp-admin/network/6cY7pV.php?r=##############
- http://ab#####travelagent.com/uploads/3/5/4/5/3545952/header_images/Cu4MYc.php?n=##############
- http://bi####ttravel.com/uploads/3/5/4/5/3545341/header_images/NthjHz.php?c=##############
- http://ca###ate.com/fr/wp-includes/css/gjtmN6.php?u=##############
- http://ci#####breakerhub.com/images/gallery/iUHldw.php?g=##############
- http://ta###hyainc.com/wp-includes/theme-compat/JFSo69.php?q=##############
- http://an####amicasa.com/wp-admin/network/uwbzts.php?i=##############
- http://ch####hitlock.com/wp-includes/js/jquery/ui/91zpeD.php?v=##############
- http://co##bar.com/wp-admin/css/wEHf2D.php?v=##############
- http://be###iktas.com/wp-content/plugins/facebook-button-plugin/bws_menu/css/gUd0qe.php?o=##############
UDP:
- DNS ASK am###astyle.com
- DNS ASK ca####onmarket.com
- DNS ASK cr######travelandmore.com
- DNS ASK bi##al.com
- DNS ASK da#####ircuitbreaker.co
- DNS ASK da#######garciniacambogia.com
- DNS ASK al####dytravel.com
- DNS ASK ca###ate.com
- DNS ASK al#######siveresortstravel.com
- DNS ASK bo#####andfurnaces.com
- DNS ASK br###erhub.com
- DNS ASK an#####csteroidsrx.com
- DNS ASK cr#####ndtravel.agency
- DNS ASK da#####estaurant.com
- DNS ASK cr#####ravelpros.com
- DNS ASK br###egenie.com
- DNS ASK en####ealtyny.com
- DNS ASK ar####arzon.info
- DNS ASK cy###lness.com
- DNS ASK al####upstravel.com
- DNS ASK su####unshoes.com
- DNS ASK de######ruiseandtravel.com
- DNS ASK ci#####breakerhub.com
- DNS ASK be####ouseplans.com
- DNS ASK ap####chatudia.com
- DNS ASK cr####ngatdawn.com
- DNS ASK br######kingsolutions.com
- DNS ASK cr####withdawn.com
- DNS ASK de####brossard.com
- DNS ASK my####rnalip.com
- DNS ASK ip##ddr.es
- DNS ASK cu###yip.com
- DNS ASK da########nditionedtransformers.com
- DNS ASK de######gartinstitute.com
- DNS ASK co##bar.com
- DNS ASK be###iktas.com
- DNS ASK ab#####travelagent.com
- DNS ASK bi####ttravel.com
- DNS ASK ab#####travelagency.com
- DNS ASK ch####hitlock.com
- DNS ASK da######rcuitbreaker.com
- DNS ASK da######ectricalsurplus.com
- DNS ASK ca#####chambers.co.uk
- DNS ASK ta###hyainc.com
- DNS ASK an####amicasa.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
