Technical Information
Malicious functions
Injects code into
the following user processes:
- iexplore.exe
Modifies file system
Creates the following files
- %APPDATA%\umsasvfdmyynq
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\b4i3kdu0\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\0qrtof5w\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\fh893dp2\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\khiv48o3\desktop.ini
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\b4i3kdu0\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\0qrtof5w\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\fh893dp2\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\khiv48o3\desktop.ini
Network activity
UDP
- DNS ASK ma###.hostport9.net
- DNS ASK vh#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK gh#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK 45#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK av#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK X4#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK c9##HuNROa/swLESFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK /6EqHmQWaurswLESFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK qt#kHiz/nszswLESFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK 3+#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK /dqxHsFSrFXswLESFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK dW#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK 0c#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK Wq#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK cH#/HqdLrQDswLESFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK IR#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK jR#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK qV#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK Z1#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK kjktHpi//1L##########NlFjKwIgNrV.mailj.hostport9.net
- DNS ASK rD#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK zK#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK 27#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK Im#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK F/ObHvdkX/LswLESFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK HX#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK Mq#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK KK##Ht39bl/swLESFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK Xy#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK zj#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK EF#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK pB#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK pK#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK KT#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK 8k#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK ve#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
- DNS ASK 0I#############SFaIzgNlFjKwIgNrV.mailj.hostport9.net
Miscellaneous
Executes the following
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe'
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
