Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '<SYSTEM32>\ctfmon.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '1774804924' = '%LOCALAPPDATA%\igp.exe'
- [<HKCU>\Software\Classes\.exe] '' = 'exefile'
- [<HKCU>\Software\Classes\.exe] 'Content Type' = 'application/x-msdownload'
- [<HKCU>\Software\Classes\.exe\shell\open\command] '' = '"%LOCALAPPDATA%\igp.exe" -a "%1" %*'
- [<HKCU>\Software\Classes\exefile\shell\open\command] '' = '"%LOCALAPPDATA%\igp.exe" -a "%1" %*'
- [<HKLM>\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command] '' = '"%LOCALAPPDATA%\igp.exe" -a "%ProgramFiles(x86)%\Mozilla Firefox\firefox.exe"'
- [<HKLM>\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command] '' = '"%LOCALAPPDATA%\igp.exe" -a "%ProgramFiles(x86)%\Internet Explorer\iexplore.exe"'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Security Center
- Windows Defender
blocks the following features:
- Windows Action Center
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
the following user processes:
- iexplore.exe
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\fpa2c4.tmp
- %TEMP%\neja2d4.tmp
- %TEMP%\fpa2f5.tmp
- %TEMP%\fpa305.tmp
- %TEMP%\fpa316.tmp
- %LOCALAPPDATA%\igp.exe
- %TEMP%\fpbb91.tmp
- %TEMP%\nejbbc1.tmp
- %TEMP%\fpbc00.tmp
- %TEMP%\fpbc8e.tmp
- %TEMP%\fpbccd.tmp
- %LOCALAPPDATA%\x07sdu2726ts61
- %ALLUSERSPROFILE%\x07sdu2726ts61
- %TEMP%\x07sdu2726ts61
- %APPDATA%\microsoft\windows\templates\x07sdu2726ts61
Deletes the following files
- %TEMP%\fpa2c4.tmp
- %TEMP%\neja2d4.tmp
- %TEMP%\fpa2f5.tmp
- %TEMP%\fpa305.tmp
- %TEMP%\fpa316.tmp
- %TEMP%\fpbb91.tmp
- %TEMP%\nejbbc1.tmp
- %TEMP%\fpbc00.tmp
- %TEMP%\fpbc8e.tmp
- %TEMP%\fpbccd.tmp
Deletes itself.
Network activity
Connects to
- 'microsoft.com':80
UDP
- DNS ASK da###ufigaj.com
- DNS ASK ci####rijugeg.com
- DNS ASK le####jezociw.com
- DNS ASK si####qilugoq.com
- DNS ASK sy####lurypugi.com
- DNS ASK pe###ehywe.com
- DNS ASK ku###ijige.com
- DNS ASK vo###aqyr.com
- DNS ASK jy####fisanu.com
- DNS ASK ra####bareme.com
- DNS ASK qy####ronysos.com
- DNS ASK zi####qeqite.com
- DNS ASK me####lykowuw.com
- DNS ASK ty####laresuz.com
- DNS ASK za####cypase.com
- DNS ASK ga####lerilir.com
- DNS ASK de###iqut.com
- DNS ASK qo###avede.com
- DNS ASK la####cosibuw.com
- DNS ASK he###ixiru.com
- DNS ASK qo###ifelaw.com
- DNS ASK gi###eceta.com
- DNS ASK gi####powaqa.com
- DNS ASK microsoft.com
- DNS ASK wa###opani.com
- DNS ASK ve###utuk.com
- DNS ASK do####cufinulo.com
- DNS ASK po###ybaru.com
- DNS ASK ro####zanasi.com
- DNS ASK wy###ediwo.com
- DNS ASK zy####wodojyx.com
- DNS ASK ti###uqel.com
- DNS ASK vo####lyxiqo.com
- DNS ASK ti###abutal.com
- DNS ASK fo####wupode.com
- DNS ASK su###ebaq.com
- DNS ASK he###yheduf.com
- DNS ASK za####tahuryp.com
- DNS ASK mu###ahyxar.com
- DNS ASK fi####gymeba.com
- DNS ASK tu####kenuqi.com
- DNS ASK xo###ipowu.com
- DNS ASK pu####cyvazym.com
- DNS ASK di###akiri.com
- DNS ASK le###ehup.com
- DNS ASK fe####holubaro.com
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
- ClassName: 'msascui_class' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'Media Center Tray Applet' WindowName: ''
- ClassName: '' WindowName: 'View Available Networks'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''
Creates and executes the following
- '%LOCALAPPDATA%\igp.exe' -gav <Full path to file>
Executes the following
- '%WINDIR%\explorer.exe'
